Privacy by Architecture, Not by Promise
Placino's security model is built on cryptographic guarantees, not trust. Data stays encrypted end-to-end. Governance is automated and verifiable. Compliance is embedded, not bolted-on.
Full security documentation (architecture, controls, and penetration-test summary) is available to prospects on request.
The Security Model
Six Pillars of the Clean Room
Every query passes through six independent layers of protection. Each pillar is enforced by architecture, not by policy documents.
Envelope Encryption Architecture
AES-256-GCM Per-Upload
Every dataset uploaded to Placino is encrypted at rest using AES-256-GCM (Galois/Counter Mode), the standard for authenticated encryption. Each upload receives a unique encryption key and initialization vector (IV).
- 256-bit symmetric encryption
- Authenticated encryption with associated data (AEAD)
- Unique IV per upload prevents replay attacks
- Hardware-accelerated on modern CPUs
RSA-4096 Envelope Wrapping
Data encryption keys are wrapped in RSA-4096 public keys. Only organizations holding the private key can access plaintext. Key material never travels in plaintext through the network.
- 4096-bit RSA key strength (100+ year horizon)
- OAEP padding for semantic security
- Key rotation without re-encrypting data
- Hardware security module (HSM) compatible
Ephemeral SHA-256 Hashing
Identity matching uses salted SHA-256 join hashes. Match computation runs in-memory per session using a per-room salt, so the same identifier resolves consistently while raw identifiers are never exchanged between parties. Stored join-hash values stay envelope-encrypted (AES-256-GCM + RSA-4096) at rest.
- Deterministic hashing for consistency, per-room salt for isolation
- Stored join-hash values remain envelope-encrypted (AES-256-GCM + RSA-4096)
- Per-room salt scopes hashes to a single collaboration
- Resistant to precomputation and rainbow tables
Privacy Controls & Enforcement
Differential Privacy
Add mathematically-proven noise to query results. Control the privacy-utility tradeoff with epsilon budgets.
- Laplace mechanism (for sum/count)
- Gaussian mechanism (for mean/variance)
- Per-tenant / per-agreement (DUA) epsilon budget tracking
- Budget composition bounds
K-Anonymity
Ensure no individual can be re-identified. Suppress any result group below the k-anonymity threshold so each person is indistinguishable from at least k-1 others.
- Configurable k threshold (default k=5)
- Record suppression for small groups
- Enforced on query result sets
Column-Level Permissions
Grant or deny access at the column level. Sensitive columns can be masked, hashed, or restricted to specific roles.
- Role-based access control (RBAC)
- Column masking (redaction/hashing)
- Data classification tags
- Enforcement in query execution engine
Purpose Limitation
Bind datasets and segments to specific approved uses. Prevent unauthorized secondary uses of data.
- Purpose tags on datasets and segments
- Enforcement in query validation
- Semantic guardrails for intent detection
- Audit logging of purpose violations
Enterprise Governance
Merkle-Chain Audit Trails
Every query, data access, and permission change is recorded in an immutable Merkle-chained log. Tampering is cryptographically detectable.
- Hash-chained audit logs (Merkle tree)
- Append-only with no update or delete
- Cryptographic integrity verification
- Export for compliance reviews
- Streaming audit-event ingestion (Kafka)
Use audit logs to prove compliance during audits, investigate security incidents, and track data lineage.
When sensitive queries are detected, system automatically creates approval requests routed to data stewards.
Just-In-Time Approval Workflows
Sensitive queries require approval before execution. Configurable policies determine which queries require sign-off. Audit trail records approver, time, and justification.
- Policy-driven approval triggers
- Multi-approver workflows
- Time-gated approval expiry
- Approval delegation and escalation
- Audit trail of approvals
Automated DSAR Handling
Respond to Data Subject Access Requests in minutes, not weeks. Placino automatically finds, assembles, and delivers an individual's data across all datasets.
- Cross-dataset data subject discovery
- Automated data extraction and compilation
- DSAR workflow management
- Secure delivery channel (encrypted export)
- Proof of compliance (audit trail)
GDPR Article 15 responses completed automatically. Audit logs prove timely, accurate response.
Decouple policy from code. Update access policies without redeploying. Version control your policy as code.
OPA Policy Engine
Open Policy Agent integration for fine-grained access control. Write policies in Rego. Enforce at query execution time.
- Rego policy language (declarative)
- Role-based, attribute-based, resource-based access
- Policy versioning and rollback
- Policy testing framework
- Deny policies (blacklist approach)
Compliance Framework Alignment
Placino's controls are mapped to these frameworks and backed by self-hosted data residency and audit-ready evidence. Control alignment is not an independent certification.
GDPR
CCPA/CPRA
KVKK
HIPAA
SOC 2 (aligned)
Mapping Details
- GDPR: Data protection by design, encryption, DPIA support, DSAR automation, audit trails
- CCPA/CPRA: Consumer rights automation, transparency logs, opt-out enforcement
- KVKK: Explicit consent tracking, purpose limitation, data localization support
- HIPAA: PHI encryption, access controls, audit logging, BAA-ready architecture
- SOC 2 (aligned): audit trails, change management, access controls, and incident response mapped to the Trust Services Criteria with audit-ready evidence, not yet a SOC 2 Type II attestation
Zero-Trust Architecture
3 Isolated Networks
Placino's architecture is split into three Docker network tiers by trust level: an external edge network and two internal-only networks that are unreachable from the internet. All traffic enters through the APISIX gateway.
- Edge network: only the APISIX gateway is internet-facing
- Backend network (internal-only): matching, queries, AI, ingestion
- Data network (internal-only): Postgres, ClickHouse, object storage
Network Segmentation
Layer 7 (application-level) firewalls between networks. Services communicate via encrypted channels with mutual TLS.
No Egress by Default
The internal service networks have no default internet egress. External database connectors route outbound through a controlled, explicitly-configured path.
Zero-Data-Movement Architecture
Placino’s architecture ensures raw data never moves between parties. Only encrypted insights are shared, whether you deploy on our managed SaaS, dedicated tenant, or self-hosted infrastructure.
- Inbound-only API endpoints
- No automatic cloud backups
- Local storage by default
- Optional encrypted export for backup
Security Best Practices
TLS Everywhere
- TLS 1.3 for all network communication
- Mutual TLS (mTLS) for service-to-service
- Certificate pinning for external APIs
Key Management
- Hardware security module (HSM) support
- Automated key rotation policies
- Separate keys per customer, per environment
Access Control
- Principle of least privilege
- Multi-factor authentication (MFA)
- Session timeouts and rate limiting
Monitoring & Response
- Continuous audit-log monitoring
- Security event alerting
- Automated incident response workflows
Security is Not Optional
Every layer of Placino is built with cryptographic guarantees. No backdoors. No trust required. Compliance built in, not bolted on.