Census is the Reverse ETL platform for your enterprise

Unlike other Reverse ETL platforms, Census was designed from day one to run inside your data warehouse. Our unique “low touch” sync architecture leverages your data warehouse’s own execution engine to perform sensitive operations, meaning that validation, transformation, and state tracking all happen without your data ever touching Census's servers. This ensures speed and security and makes Census “secure by default” against many common attacks.

Census is the only major Reverse ETL platform that does not store a second copy of your data. We perform most of the “logic” for determining what records need to be synced — and how to match those records to your existing data — within your own warehouse.

Census does not require superuser access to your data warehouse, and will request the fewest OAuth scopes needed for your SaaS applications (subject to SaaS provider support). Connections between your data warehouse and shared resources such as S3 buckets are performed using minimum privilege STS credentials with short expiration times.

Safeguarding our customers’ personal data is our fundamental responsibility. Census is the first Reverse ETL platform to obtain a SOC 2 certification, and we regularly audit our policies and procedures to ensure compliance with ongoing HIPAA and SOC 2 requirements.

Request our SOC 2 report →

Customers can choose to keep all their data within the EU throughout the duration of a Census sync, hosted in Frankfurt (AWS eu-central-1). We never store your data, but your selected region determines where data is processed during your Census syncs.

If your data does transit through Census's servers, it is encrypted in transit and securely removed the moment it reaches the ultimate destination. Census uses recent TLS versions for all connections between systems: from your browser to our application, from our servers to your data warehouse or SaaS application, and internally between our own services and databases. We do not use self-signed certificates and we regularly audit TLS versions and ciphersuites to avoid any newly discovered weaknesses. Census encrypts its own databases and blob storage at rest and applies an additional layer of asymmetric encryption to protect our core application secrets, like OAuth credentials and API keys.

Census is fully compliant with GDPR regulations that ensure the privacy, protection, and security of personal information. We continuously evaluate our practices to prioritize and mitigate risks, and we are transparent about how customer data is collected, processed and stored. We have a Data Process Addendum available.

Request our DPA →

We seamlessly support over 10,000 data consumers with enterprise-grade SAML 2.0 SSO, which makes signing in with your existing identity provider easy. You can sign in with:

• Okta
• OneLogin
• PingIdentity
• ADFS
• WorkOS
• Or any of dozens of other SAML 2.0 IdPs

Easily use your AWS KMS keys to encrypt all of your SaaS and warehouse credentials and define policies consistently with centralized key management.

Census provides detailed logs, stored in your private warehouse, of each data point that is synced so you can audit, troubleshoot, and create alerts using the most granular information.

• See our Observability page for more around smart alerting and real-time visibility.

Integrate with SIEM solutions like Splunk to detect and identify threats to your data more quickly and accurately with a holistic view of security events, especially from anomalous user actions.

Contact your Account Executive to request access

Census records audit logs of any changes made to your datasets or sync configurations, telling you which users made changes and when. This includes changes made by Census sales engineers and professional services staff.

Bring your own private cloud by using private IP addresses in your VPC to connect securely within the AWS network. You also have the option to manage your own S3 bucket for legal or regulatory reasons, adding another layer of security to your pipeline.

Role-based access controls enable administrators to control user and role permissions at a granular level. Approved administrators can configure the access list to quickly manage permissions within the Census UI.

Workspaces enable administrators to organize users and manage permissions for different teams, projects, or use cases. They can organize syncs and models in Workspaces however they wish. Each individual user can have a different role in each individual workspace they belong to.

Achieve transparency, auditing, and version control by editing Census syncs, models, and connections within your established code management framework.

• Manage your syncs via Census’s API
• Manage your syncs using native Git integration — GitLink (Configuration as Code)

Network administrators have multiple options to deploy additional layers of security:

• IP Safelist: Grant network access only to specific, pre-approved IP addresses to enforce authorized access and gain visibility into security events.
• SSH Tunneling: Limit exposure and add network security to legacy applications that do not natively support encryption.
• Key Pair Authentication: No need to share passwords with Census in order to connect through SSH bastions - we use keypairs to minimize the risk of disclosure of a shared secret.

Our team has never missed an SLA. The Census platform has 99.5% uptime with immediate status updates if anything goes wrong.

Census status page

Customer Data Architects who are former Heads of Data help you stand up the most performant and secure data architecture and modeling best practices. We offer live support through email, chat, or Slack, and dedicated account managers guide you every step of the way to ensure success.

----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBF8oSYABCAC4hpCT7QKcZYv5FZ/+tyU/zGOZbbvWOirHnV14voWK6kCm1fy00YsQLZFQ+hBzSE+E1c/Z9d/7RPTQuUz3orW9KJ+UV8uN1Yb2qNSoHljq5W5fvFtQP5nLEMZYXuX9npLfWmRveaawydaS2QKMQp1V5U6mIaYlajAi+X5LBzylaxtIC6vuOnzxGEBl3dO3rklq63MauYymf3UENtbMXdN1WxSjApGM+sBNMaczphOvyURsFRLGiOifiXQ4zpDDljTOxqGXjNhv9WzxgcC3+TpXnNr5eAYoEvk8+dGVuY75vMid+1QHU5bK69vokyyWNML30PAHM5sROx0MeG2gFABEBAAG0LUNlbnN1cyBTZWN1cml0eSBUZWFtIDxzZWN1cml0eUBnZXRjZW5zdXMuY29tPokBVAQTAQgAPhYhBA4a6TrWq1stc8Jdv4uZJVzk8U1QBQJfKEmAAhsDBQkDwmcABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEIuZJVzk8U1QAksH/1JubecTpfBYmF+q0oI8aawPp4c6k13N963U9gKwgAHevOQRgvFdqZqv58SN26cHJCA3MPnZMw3RdiGcg9FGKu9pV7pFWvYYhDjWwthfaeGVjfIC5SYuI2ddx2S1J0LgRV4EXI23ypJPVBY0drxGYYgnVLb9eLhEHA4Iv0u5iLjcOM506XrFPPf2Rbcl8I1QbvSxZviBbD3Y5M7en+sz6B9c707qVLdqiiLmnasxnvAStcWhWP3mycZ1Mq41tLxJYeVJ/037DgiUrmD1XYMdNaost9Yblvg+w6nOMjTSUfezXzLfk6giXyY1B4cTxWtWzL6E1tNI65S9ZZW1Sp1y5AQ0EXyhJgAEIALZhE+hzNth5pgeCQtq4C7zejJZXwuiwyVDJUDatbRyhTWpkIW93MRMIFpDse1EZ57GgQDTAqmObIAtg5KxE+8+U68hP3LmI6eHCPJrveFZe4+lfIycxC7DrKNU3zAIzCTgQApJL2g84cnASjVdhPc4UmYcsqUjsdYVg1HB6hm2IOOg2m72SPCZfuDK5tlsoqYMKpx1+zt4lCIIlndqRYHGD4NJSI8aUjvd/5OTqsOU3WZ74YlNV8zJo21Qn3Ts5hyKBcOjP1922CImO2jnv8IjBiGnSBGBW5tozcP9TrYbjMsZJS37EcHsJpJCHoZ+3Gmgq9+H3gXD2KSRtOOMUAEQEAAYkBPAQYAQgAJhYhBA4a6TrWq1stc8Jdv4uZJVzk8U1QBQJfKEmAAhsMBQkDwmcAAAoJEIuZJVzk8U1QezQHiuj1qC9PRTQjc1YlCYSYatdDY2ij5YobHHUBCJLwv2lVxHjI9gU43Vi1ZhHwtHOYKZcupzlh6e5+1aGVbKTUSir3KEx8r8Ky86aCmjr3FDIfbEK3VarQkPAuQznBHBWDxwjbjDb9RDbb9MtvIEBuvATlXqplg9jqE6HyJgJ51rWJppsbTk9jhH8MIO6XAn242QFfcVte+273/4Rm8uxK7R9IDT9aRpDxADXRqtfaWfItkF1Qm54/2P2KzR+Qy1f013bBn9eX60s7UrhwSaSHvPrLw5SgYif1XxQMFgPouyE2tByHEMybmj5nue/m5AuVCdREstG/6H+4mSY==4JOF

-----END PGP PUBLIC KEY BLOCK----