Security and compliance

MotherDuck is designed to keep your data secure at every layer, from encryption and authentication through to access control and compliance. This page summarizes the security capabilities available across MotherDuck plans.

Data encryption

MotherDuck encrypts data both at rest and in transit.

• At rest: Data stored in MotherDuck managed storage is encrypted using AES-256 encryption in AWS.
• In transit: All connections to MotherDuck use TLS 1.2 or higher. This applies to client connections, API calls, and internal service communication.

Secrets stored using CREATE SECRET are fully encrypted and scoped to the user who created them. They are never exposed in query logs or shared with other users in your organization.

Authentication

MotherDuck supports multiple authentication methods to fit different security requirements.

Method	Description	Plan
Access tokens	Token-based authentication for CLI, SDK, and API access	All plans
SSO (SAML/OIDC)	Single Sign-On through your identity provider (Okta, Microsoft Entra ID, and others)	Business, Enterprise
SCIM provisioning	Automated user lifecycle management through your IdP	Business, Enterprise
Service accounts	Non-human accounts for programmatic access and automation	All plans

For programmatic workloads such as ETL pipelines or scheduled jobs, use service accounts with dedicated access tokens. Service account tokens can be configured with expiration times and scoped to specific Duckling sizes.

tip

If your organization requires centralized identity management, configure SSO first, then enable SCIM provisioning to automate user creation and deprovisioning.

For full details on authentication setup, see Authenticating to MotherDuck.

Access control

MotherDuck provides access control at the organization, database, and share level.

Organization roles

Every user in a MotherDuck organization receives one of three preset roles. Each role bundles platform permissions:

• Admin: Governs the organization, including billing, member and role management, SSO and SCIM configuration, and all Builder capabilities.
• Builder: Produces and manages data, secrets, service accounts, Ducklings, Dives, and Flights, but cannot manage billing, members, or roles.
• Explorer: Queries data, manages owned databases and Shares, and creates owned Dives and Flights, but cannot manage secrets, service accounts, billing, members, or roles.

The preset roles are concentric: Admin includes Builder permissions, and Builder includes Explorer permissions. Access checks evaluate the required permission, so a custom role can perform an action when it inherits a role that includes that permission. You cannot select platform permissions individually for a custom role. Data access is separate: grant Shares directly to custom roles for fine-grained access. See Roles and access control for the complete capability matrix and data-grant model.

Database sharing and permissions

You can share databases with other users in your organization or externally using MotherDuck shares. Access to shared databases is controlled with SQL commands:

• GRANT ACCESS: Grant read access to a Share for specific users or roles.
• REVOKE ACCESS: Remove a user's or role's access to a Share.

Shares are read-only by default. The owner of a database controls who can access it.

For more on sharing, see CREATE SHARE.

Network security

MotherDuck runs on AWS infrastructure with the following network security characteristics:

• Managed storage is not exposed through public IP addresses.
• All client-to-service communication is encrypted with TLS.
• MotherDuck services run within isolated AWS environments.

info

AWS PrivateLink is available on the Enterprise plan for organizations that require private connectivity to MotherDuck without traversing the public internet. Contact us for details.

Compliance

SOC 2 type II

MotherDuck is SOC 2 Type II certified. This certification covers the security, availability, and confidentiality trust service criteria. For the latest compliance details or to request the SOC 2 report, contact us.

HIPAA

For organizations that process protected health information (PHI), MotherDuck offers a Business Associate Agreement (BAA) on the Enterprise plan, available on request. Put a BAA in place before loading any PHI into MotherDuck. Contact us to request one.

GDPR and CCPA

MotherDuck supports GDPR compliance for organizations processing personal data of EU residents:

• Data residency: Choose a European region (eu-west-1 or eu-central-1) when creating your organization so all data storage and processing stays within the EU. See data residency below.
• International transfers: Where data transfers outside the EU or UK apply, MotherDuck relies on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms. See the privacy policy for details.
• Right to erasure: You control deletion through standard SQL (DELETE, DROP TABLE, DROP DATABASE). Note that deleted data remains recoverable for the duration of your snapshot retention and failsafe windows before it is physically removed; lower snapshot_retention_days or use transient databases where shorter retention is required.
• Accountability: Query history and organization access controls support your audit and accountability obligations.

The same controls (region selection, access control, deletion, and retention settings) apply to CCPA and other regional privacy frameworks. For a data processing agreement (DPA) or framework-specific contractual requirements, contact us.

Data residency

MotherDuck is available in four AWS regions:

• US East (N. Virginia): us-east-1
• US West (Oregon): us-west-2
• Europe (Dublin): eu-west-1
• Europe (Frankfurt): eu-central-1

You choose your region when creating an organization. All data storage and processing stays within the selected region. Organizations cannot span multiple regions.

The European regions (eu-west-1 and eu-central-1) support GDPR compliance requirements for organizations processing data within the European Union.

note

For additional compliance requirements or questions about specific regulatory frameworks, contact us.

Secrets management

MotherDuck provides built-in secrets management for cloud storage credentials (AWS S3, GCS, Azure, R2, Hugging Face). Secrets stored in MotherDuck are:

• Fully encrypted at rest
• Scoped to the individual user who created them
• Not shared with other organization members
• Not visible in query logs

Storing a MotherDuck secret requires permission to create secrets. Deleting one requires a separate permission to delete secrets. The Admin and Builder preset roles include both permissions by default. To store a secret, use the PERSISTENT or IN MOTHERDUCK keyword with CREATE SECRET.

CREATE SECRET IN MOTHERDUCK (
    TYPE S3,
    KEY_ID 's3_access_key',
    SECRET 's3_secret_key',
    REGION 'us-east-1'
);

Audit and monitoring

MotherDuck provides query history for audit trail and monitoring purposes.

The QUERY_HISTORY view in the md_information_schema records executed queries, including the user, execution time, and status. Reading it requires permission to view query history. Reviewing activity per Duckling in the Duckling overview requires permission to view organization-wide Duckling activity. The Admin and Builder preset roles include both permissions by default.

info

Query history is available on Business and Enterprise plans. See pricing for plan details.

Security features by plan

Feature	Lite	Business	Enterprise
Encryption at rest (AES-256)	Yes	Yes	Yes
Encryption in transit (TLS 1.2+)	Yes	Yes	Yes
Access tokens	Yes	Yes	Yes
Service accounts	Yes (2 max)	Yes (unlimited)	Yes (custom)
SSO (SAML/OIDC)	--	Yes	Yes
SCIM provisioning	--	Yes	Yes
Query history	--	Yes	Yes
AWS PrivateLink	--	--	Yes
SOC 2 Type II	Yes	Yes	Yes
HIPAA BAA	--	--	On request
Data residency (US/EU)	Yes	Yes	Yes

For full plan details, see pricing.