SECURE BY DEFAULT

Census is the Reverse ETL platform for your enterprise

Your business runs on trust. That’s why it runs on Census.

We are committed to end-to-end security and observability to keep you and your data safe. Census follows industry-leading standards while syncing your data from your warehouse to all of your apps.

Read our security paper

Request our SOC 2 report

Everything you need for enterprise compliance. By design.

The most secure and compliant Reverse ETL platform for your business, whether you’re supporting one team or every department. We guarantee full observability, security, and governance for your data pipelines.

Health Insurance Portability and Accountability Act

SOC 2 Type II
Request our SOC 2 report →

General Data Protection Regulation

Data Privacy Framework

Helping business & data teams collaborate at

Security & Compliance

The only Reverse ETL platform that doesn’t store your data

Unlike other Reverse ETL platforms, Census was designed from day one to run inside your data warehouse. Our unique “low touch” sync architecture leverages your data warehouse’s own execution engine to perform sensitive operations, meaning that validation, transformation, and state tracking all happen without your data ever touching Census's servers. This ensures speed and security and makes Census “secure by default” against many common attacks.

Census is the only major Reverse ETL platform that does not store a second copy of your data. We perform most of the “logic” for determining what records need to be synced — and how to match those records to your existing data — within your own warehouse.

Least privileges needed for handling data

Census does not require superuser access to your data warehouse, and will request the fewest OAuth scopes needed for your SaaS applications (subject to SaaS provider support). Connections between your data warehouse and shared resources such as S3 buckets are performed using minimum privilege STS credentials with short expiration times.

SOC 2/HIPAA Compliance

Safeguarding our customers’ personal data is our fundamental responsibility. Census is the first Reverse ETL platform to obtain a SOC 2 certification, and we regularly audit our policies and procedures to ensure compliance with ongoing HIPAA and SOC 2 requirements.

Request our SOC 2 report →

EU Data Locality

Customers can choose to keep all their data within the EU throughout the duration of a Census sync, hosted in Frankfurt (AWS eu-central-1). We never store your data, but your selected region determines where data is processed during your Census syncs.

Data encrypted in transit & at rest

If your data does transit through Census's servers, it is encrypted in transit and securely removed the moment it reaches the ultimate destination. Census uses recent TLS versions for all connections between systems: from your browser to our application, from our servers to your data warehouse or SaaS application, and internally between our own services and databases. We do not use self-signed certificates and we regularly audit TLS versions and ciphersuites to avoid any newly discovered weaknesses. Census encrypts its own databases and blob storage at rest and applies an additional layer of asymmetric encryption to protect our core application secrets, like OAuth credentials and API keys.

GDPR and CCPA Compliance

Census is fully compliant with GDPR regulations that ensure the privacy, protection, and security of personal information. We continuously evaluate our practices to prioritize and mitigate risks, and we are transparent about how customer data is collected, processed and stored. We have a Data Process Addendum available.

Request our DPA →

SAML SSO

We seamlessly support over 10,000 data consumers with enterprise-grade SAML 2.0 SSO, which makes signing in with your existing identity provider easy. You can sign in with:

Okta
OneLogin
PingIdentity
ADFS
WorkOS
Or any of dozens of other SAML 2.0 IdPs

Infrastructure

Customer-managed keys to protect your credentials

Easily use your AWS KMS keys to encrypt all of your SaaS and warehouse credentials and define policies consistently with centralized key management.

Auditable Sync Logs

Census provides detailed logs, stored in your private warehouse, of each data point that is synced so you can audit, troubleshoot, and create alerts using the most granular information.

See our Observability page for more around smart alerting and real-time visibility.

Logs in your SIEM

Integrate with SIEM solutions like Splunk to detect and identify threats to your data more quickly and accurately with a holistic view of security events, especially from anomalous user actions.

Contact your Account Executive to request access

Data & tools to audit your organization’s Census usage

Census records audit logs of any changes made to your models or sync configurations, telling you which users made changes and when. This includes changes made by Census sales engineers and professional services staff.

AWS PrivateLink

Bring your own private cloud by using private IP addresses in your VPC to connect securely within the AWS network. You also have the option to manage your own S3 bucket for legal or regulatory reasons, adding another layer of security to your pipeline.

Governance

Fine-grained RBAC to safely deploy across the enterprise

Role-based access controls enable administrators to control user and role permissions at a granular level. Approved administrators can configure the access list to quickly manage permissions within the Census UI.

Workspaces enable administrators to organize users and manage permissions for different teams, projects, or use cases. They can organize syncs and models in Workspaces however they wish. Each individual user can have a different role in each individual workspace they belong to.

Advanced authentication

Network administrators have multiple options to deploy additional layers of security:

IP Safelist: Grant network access only to specific, pre-approved IP addresses to enforce authorized access and gain visibility into security events.
SSH Tunneling: Limit exposure and add network security to legacy applications that do not natively support encryption.
Key Pair Authentication: No need to share passwords with Census in order to connect through SSH bastions - we use keypairs to minimize the risk of disclosure of a shared secret.

Programmatic sync management

Achieve transparency, auditing, and version control by editing Census syncs, models, and connections within your established code management framework.

Manage your syncs via Census’s API
Manage your syncs using native Git integration — GitLink (Configuration as Code)

Professional Services

Best-in-class SLAs

Our team has never missed an SLA. The Census platform has 99.5% uptime with immediate status updates if anything goes wrong.

Census status page

Premium Support

Customer Data Architects who are former Heads of Data help you stand up the most performant and secure data architecture and modeling best practices. We offer live support through email, chat, or Slack, and dedicated account managers guide you every step of the way to ensure success.

More Information and Responsible Disclosure

Our security is always improving. If you’d like to learn more about our data protection processes, email us.

If you are a security researcher and would like to disclose an issue, contact security@getcensus.com. We are strong advocates for responsible disclosure by independent security researchers. We believe the best way to protect current and future customers is to encourage researchers to come forward with issues and reply promptly.

Our promise to you is:

We will read and respond to all reported vulnerabilities.
We will not take any harmful action (including legal action) against researchers who act ethically and in good faith.
We will highlight the contributions of security researchers who make significant reports.

In return we ask:

That you do not attempt to access, modify, or delete data belonging to Census customers.
That you report issues promptly once discovered.
That you do not attempt denial of service against the Census application.

Should you wish to encrypt your correspondence, our public key is ↓

----BEGIN PGP PUBLIC KEY BLOCK----- mQENBF8oSYABCAC4hpCT7QKcZYv5FZ/+tyU/zGOZbbvWOirHnV14voWK6kCm1fy00YsQLZFQ+hBzSE+E1c/Z9d/7RPTQuUz3orW9KJ+UV8uN1Yb2qNSoHljq5W5fvFtQP5nLEMZYXuX9npLfWmRveaawydaS2QKMQp1V5U6mIaYlajAi+X5LBzylaxtIC6vuOnzxGEBl3dO3rklq63MauYymf3UENtbMXdN1WxSjApGM+sBNMaczphOvyURsFRLGiOifiXQ4zpDDljTOxqGXjNhv9WzxgcC3+TpXnNr5eAYoEvk8+dGVuY75vMid+1QHU5bK69vokyyWNML30PAHM5sROx0MeG2gFABEBAAG0LUNlbnN1cyBTZWN1cml0eSBUZWFtIDxzZWN1cml0eUBnZXRjZW5zdXMuY29tPokBVAQTAQgAPhYhBA4a6TrWq1stc8Jdv4uZJVzk8U1QBQJfKEmAAhsDBQkDwmcABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEIuZJVzk8U1QAksH/1JubecTpfBYmF+q0oI8aawPp4c6k13N963U9gKwgAHevOQRgvFdqZqv58SN26cHJCA3MPnZMw3RdiGcg9FGKu9pV7pFWvYYhDjWwthfaeGVjfIC5SYuI2ddx2S1J0LgRV4EXI23ypJPVBY0drxGYYgnVLb9eLhEHA4Iv0u5iLjcOM506XrFPPf2Rbcl8I1QbvSxZviBbD3Y5M7en+sz6B9c707qVLdqiiLmnasxnvAStcWhWP3mycZ1Mq41tLxJYeVJ/037DgiUrmD1XYMdNaost9Yblvg+w6nOMjTSUfezXzLfk6giXyY1B4cTxWtWzL6E1tNI65S9ZZW1Sp1y5AQ0EXyhJgAEIALZhE+hzNth5pgeCQtq4C7zejJZXwuiwyVDJUDatbRyhTWpkIW93MRMIFpDse1EZ57GgQDTAqmObIAtg5KxE+8+U68hP3LmI6eHCPJrveFZe4+lfIycxC7DrKNU3zAIzCTgQApJL2g84cnASjVdhPc4UmYcsqUjsdYVg1HB6hm2IOOg2m72SPCZfuDK5tlsoqYMKpx1+zt4lCIIlndqRYHGD4NJSI8aUjvd/5OTqsOU3WZ74YlNV8zJo21Qn3Ts5hyKBcOjP1922CImO2jnv8IjBiGnSBGBW5tozcP9TrYbjMsZJS37EcHsJpJCHoZ+3Gmgq9+H3gXD2KSRtOOMUAEQEAAYkBPAQYAQgAJhYhBA4a6TrWq1stc8Jdv4uZJVzk8U1QBQJfKEmAAhsMBQkDwmcAAAoJEIuZJVzk8U1QezQHiuj1qC9PRTQjc1YlCYSYatdDY2ij5YobHHUBCJLwv2lVxHjI9gU43Vi1ZhHwtHOYKZcupzlh6e5+1aGVbKTUSir3KEx8r8Ky86aCmjr3FDIfbEK3VarQkPAuQznBHBWDxwjbjDb9RDbb9MtvIEBuvATlXqplg9jqE6HyJgJ51rWJppsbTk9jhH8MIO6XAn242QFfcVte+273/4Rm8uxK7R9IDT9aRpDxADXRqtfaWfItkF1Qm54/2P2KzR+Qy1f013bBn9eX60s7UrhwSaSHvPrLw5SgYif1XxQMFgPouyE2tByHEMybmj5nue/m5AuVCdREstG/6H+4mSY==4JOF -----END PGP PUBLIC KEY BLOCK----

From your warehouse to your favorite apps.

Without custom code or CSVs.

Start using Census today by booking a demo with one of our experts.

Book a demo

Start a trial