Skip to main content

Security Overview

Network Security​

Plato is a cloud service that connects to your database over the internet. We also offer a self-hosted version of Plato that runs on your own servers or inside your VPC, which you can get by contacting support@plato.io.

Firewall​

If your database powers a production application or contains sensitive data, we strongly recommend running it behind a firewall that limits connectivity to known network addresses. To connect Plato, you can then whitelist our IP address, 34.82.67.27.

Please see How to connect a database for more details.

SSL​

We strongly recommend you encrypt traffic between Plato and your database by configuring Plato to connect over an SSL connection.

For additional security, you may choose to authenticate Plato’s database user with an SSL client certificate. SSL certificates provide additional security on top of username/password auth, because they cannot be phished, guessed, or socially engineered. To authenticate with an SSL certificate, your database must first be configured to accept SSL as a client authentication mechanism.

Please see How to connect a database for more details.

Data Security​

Plato never stores your row data. All queries run by Plato are executed against your live database.

When you connect a database, Plato does encrypt and store your access credentials.

Application Security​

While Plato is a convenient tool for making manual updates to your database, it is often wise to configure your database or individual tables to be read-only. Plato offers two different ways to do this.

Database Level Security​

We strongly recommend provisioning a new user to connect Plato to your database. To ensure no user in your workspace ever uses Plato to write to your database, you may choose to configure this user to have read-only access.

Access Control​

Plato lets you secure your data with a simple locking feature that marks data as read-only. You can lock data at the database, table, and column levels.

Databases​

After you connect a new database, it is locked by default.

To unlock a database:

  1. Click on the database in the nav bar.
  2. Click “Unlock database”.

Tables​

If a database is locked, all of its tables are also locked. To unlock a table, you must first unlock its database.

Once you unlock the database, you can lock specific tables. To lock a table:

  1. Click on the table in the left-hand nav bar.
  2. Click on the vertical ellipsis on the right-hand side of the tables control bar.
  3. Click “Lock table”.

A note on joins: if you expand a linked record column, the columns of its target table will be editable if and only if the base table is unlocked. In other words, the lock state of the joined table is determined by the lock state of the base table.

Columns​

If a table is locked, all of its columns are also locked. To unlock a column, you must first unlock its table.

Once a table is unlocked, you can lock specific columns. To lock a column:

  1. Right click on the column header.
  2. Click “Lock column”.

Plato provides a builtin way to secure your data via a simple feature called locking. Users in Plato cannot write to a locked database or table. If a database is locked, all of its tables are also locked.

New databases connected to Plato are locked by default.

To unlock a database:

  1. Click on the database in the left-hand nav bar.
  2. Click “Unlock database”.

To lock a table (if its database is unlocked):

  1. Click on the table in the left-hand nav bar.
  2. Click on the dots icon on the right-hand side of the tables control bar.
  3. Click “Lock table”.

Compliance​

HIPAA​

If you require HIPAA compliance, we recommend the self-hosted version of Plato, which runs on your own servers or VPC. While running the self-hosted option, your PHI remains in your own network and is never sent to Plato’s servers. Self-hosted Plato is automatically HIPAA compliant with no need for a BAA.