Dovre

Security

Security in every layer.

Dovre builds on Google Cloud's physical and network security and adds its own layers on top: encryption you can own, access that's checked on every request, and a record of everything that happens.

01Layers

Defence in depth, by default.

No single control carries the whole load. Each layer assumes the one before it might fail.

  1. 1.1

    Encryption at rest

    Data is encrypted with AES-256 before it is written to disk, in every region.

    AES-256
  2. 1.2

    Encryption in transit

    TLS on every connection: from your systems to Dovre, and between regions during replication.

    TLS
  3. 1.3

    Customer-managed keys

    Keep the keys yourself. Revoke a key, and the data it protects can no longer be decrypted.

    CMK
  4. 1.4

    Zero trust access

    Every request is authenticated and authorised, including requests from inside the network.

    ZT
  5. 1.5

    Single sign-on and MFA

    Connect your identity provider and require multi-factor authentication for everyone.

    SSO · MFA
  6. 1.6

    Audit log

    Every read, write and permission change is recorded, so you can always see who did what, and when.

    R / W / ACL
  7. 1.7

    Versioning and recovery

    Restore deleted or overwritten files, and recover from ransomware without paying anyone.

    VER

02Policy

Rules written down, applied everywhere.

Describe residency, replication, encryption and logging in a storage policy. Dovre applies it to every object in the bucket and tells you when every replica is in sync.

  • ResidencyPin a bucket to the Nordics. Writes that would break the rule are refused.
  • ReplicasChoose where copies live, and see their sync status at a glance.
  • Key ownershipDecide per bucket whether keys are managed by Dovre or by you.
  • LoggingTurn on audit logging once, and it covers every object in the bucket.
policy.yamlexample 
# dovre storage policybucket: "customer-records"residency: nordics-onlyreplicas:  - sweden  - finland  - norwayencryption:  at_rest: AES-256  keys: customer-managedaudit_log: enabled ✓ policy applied, 3/3 replicas in sync

03Compliance

GDPR, in writing.

Good intentions don't pass an audit. Here is what you get on paper.

  • Data processing agreementA clear DPA under GDPR that sets out what we do with your data, and what we don't.
  • Sub-processor listAn up-to-date list of every sub-processor, starting with Google Cloud.
  • EU/EEA storageYour data is stored only in Sweden, Finland and Norway, all inside the EU/EEA.
  • You control deletionDelete data whenever you need to, and keep the audit trail that shows it happened.
DPAfor every customer
GDPRin all three countries
100%of access logged
0bytes outside the Nordics

04FAQ

About security.

Who can access my data?

Only the users and systems you grant access to. Every access is authenticated, authorised and logged.

What happens if we revoke our key?

Data protected by a customer-managed key can't be decrypted while the key is revoked. Restore the key, and access is restored.

Do you sign a data processing agreement?

Yes. Every customer gets a data processing agreement under GDPR, with a list of sub-processors.

How do I report a security issue?

Email hello@dovre.io with “Security” in the subject line, and we'll get back to you.

Contact

Tell us what you need to store, and we'll show you how Dovre can keep it safe in the Nordics.

hello@dovre.io