Castodia's Google Single Sign-on allows you to authenticate users in your own systems without requiring additional login credentials.
We enable Owner, Billing, Admin, and Member permission levels within the Castodia app.
Admin permissions ensure only authorized users can remove team members, change other teammates' permission levels, and edit database sources.
Owner permissions ensure nobody else can delete or remove your workspace. Only owners can control billing and invoicing settings. This role is typically used by IT teams who manage the account for the company.
You own all of your data. Castodia does not copy, store, or use your data in any way other than to provide our services, specifically to load data from your databases to Google Sheets. Our servers query data from your database or source system and write it to your Google Sheets via Google services. Once data is written to Google Sheets, no data is retained in our servers. We only store logs, metadata (e.g. number or rows written), and error messages related to the auto-refresh job in order to provide an auditable trail of all runs from our server.
All Castodia services are hosted with Amazon Web Services (AWS) in the United States.
We have the ability to leverage multiple AWS availability zones and we will be able to quickly restore availability should any data center fail.
All of our servers are located within an isolated Private Virtual Network separated from other internal & external networks that prevent unauthorized access.
All data sent to or from your database and data sources to Google Sheets is encrypted in transit. All source credentials stored by Castodia are encrypted at rest, using 256 bit encryption. Our API and application endpoints are TLS/SSL only.
We use AWS backup services to reduce any risk of data loss in the event of a hardware failure, backup to multiple data centers and utilize a number of monitoring services to alert the team in the event of any failures affecting users.
Access to Castodia production infrastructure is limited to authorized employees who require it for their role. Changes are automated using access roles with the least required permissions.
Every Castodia page and service is served over HTTPS.
We have and strong password policies on GitHub, Google Workspace, AWS and other critical tools and services to ensure access to cloud services are protected. When employees leave Castodia, accounts tied to employee emails are disabled.
Castodia adheres to the principle of least privilege with respect to identity and access management.
All payments made to Castodia go through our payments partner, Stripe. Details about their security setup and PCI compliance can be found here.
Castodia is currently evaluating SOC 2 Type 2 compliance process and vendors. We expect to complete evaluation and selection process in 2023.
Castodia performs background checks on all new full-time employees in accordance with local laws. The background check includes employment verification and criminal checks for employees.
All Castodia employees are required to sign a confidentiality and non-disclosure agreements before they begin.
