The Kloudfuse data plane runs in your VPC. Control what enters the platform, authenticate and encrypt ingest, protect data at rest, enforce fine-grained access policies, audit activity, and selectively delete data when required.
Kloudfuse runs a split architecture. The data plane, meaning ingest, storage, the query engine and the AI runtime, deploys entirely within your own cloud account, reading and writing your object storage under your keys, across multiple availability zones.
Because the platform runs where your data already is, questions about residency, sub-processors and cross-border transfer are answered by your own controls rather than by our attestations.
Apply collection-time controls before telemetry is ingested. Redact or drop sensitive fields where supported, shape and relabel telemetry, and authenticate ingestion using scoped credentials.
Handling a field at collection changes what is in scope rather than what is protected, which is a materially different conversation with an auditor.
log_processing_rules of type mask_sequences on the Datadog agent; OTTL statements such as replace_pattern() and delete_key() in the collector's transform processor.exclude_at_match and include_at_match drop or keep whole log sources on the agent. The collector's filter processor drops by severity or pattern.# conf.d/<source>.d/conf.yaml, or globally under logs_config log_processing_rules: - type: mask_sequences name: mask_card_numbers replace_placeholder: "[REDACTED]" pattern: "\d{13,19}"
processors: transform/mask: log_statements: - context: log statements: - replace_pattern(body, "password=[^\s&]+", "password=***")
Every endpoint that accepts telemetry encrypts the connection and authenticates the sender. Because the ingest tier runs inside your own VPC, that connection is typically a hop within your own network rather than a crossing of the public internet.
Representative of the policy screen. Every change here is written to the audit log.
Access control answers two separate questions for every request: what telemetry this identity can query, and what content it can see and edit. They are enforced on different paths, so a team can be given dashboards without being given the data behind them.
default_rbac_policy decides what happens to an Editor or Viewer with no explicit policy. Set it to rbac_allow_none and access is denied on all streams until a policy grants it, which makes least privilege the default rather than the exception.Configuration changes and queries are recorded and queryable alongside everything else, with the same tooling as the rest of your telemetry rather than through a separate export path.
When something sensitive does land, deletion is a supported operation rather than a support ticket.
Configuration changes and queries land in the same store as your telemetry, queryable with the same tooling.
Every Kloudfuse container image in ECR is cryptographically signed, and you can verify the signature yourself before anything is deployed into your cluster.
cosign using an AWS KMS key, with signatures stored as OCI artifacts alongside the image. The signing key is asymmetric and the private half never leaves KMS.Because deployment happens inside your own VPC, residency and data-handling requirements are governed by your controls rather than ours. These three groups are deliberately distinct: an independent attestation, a cryptographic validation and a framework we help you meet are not the same kind of claim.
CMVP certificates #5186 and #5209
Erasure via scrubbing; data stays in your region
Collection-time controls and detection
Run Kloudfuse against your own telemetry, in your own cloud, and walk your security team through where the data sits and who can reach it.