Category: Security and Compliance

The Security and Compliance category provides comprehensive guidance on securing Geode deployments and meeting regulatory requirements. From authentication and encryption to audit logging and privacy compliance, these resources help you build and maintain secure, compliant graph database systems. <h3 id="security-architecture" class="position-relative d-flex align-items-center group"> Security Architecture <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-architecture" aria-haspopup="dialog" aria-label="Share link: Security Architecture"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Geode implements defense-in-depth security with multiple layers protecting your data at every point in its lifecycle. Security is not an add-on but a fundamental aspect of Geode’s architecture, with mandatory encryption, comprehensive access controls, and detailed audit capabilities built into the core system. <h4 id="security-layers" class="position-relative d-flex align-items-center group"> Security Layers <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-layers" aria-haspopup="dialog" aria-label="Share link: Security Layers"> Share link </button> </h4>Network Security: All client-server communication uses QUIC protocol with mandatory TLS 1.3 encryption. There is no plaintext fallback - encryption is always enabled, protecting data in transit against eavesdropping and tampering. Authentication: Verify identity before granting any access using username/password, certificate-based authentication, or integration with external identity providers. Authorization: Control what authenticated users can do through role-based access control (RBAC) and Row-Level Security (RLS) policies that filter data based on user attributes. Encryption: Protect data at rest with Transparent Data Encryption (TDE) for all database files and Field-Level Encryption (FLE) for sensitive attributes requiring application-controlled keys. Audit Logging: Record all database operations, authentication attempts, and authorization decisions for compliance, forensics, and threat detection. Data Integrity: ACID transactions with cryptographic checksums ensure data cannot be corrupted, whether by bugs, hardware failures, or malicious actors. <h3 id="authentication" class="position-relative d-flex align-items-center group"> Authentication <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authentication" aria-haspopup="dialog" aria-label="Share link: Authentication"> Share link </button> </h3> <h4 id="user-authentication" class="position-relative d-flex align-items-center group"> User Authentication <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="user-authentication" aria-haspopup="dialog" aria-label="Share link: User Authentication"> Share link </button> </h4>Geode supports multiple authentication mechanisms: Username and Password: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">import geode_client async def connect_with_password(): client = geode_client.open_database("quic://localhost:3141") async with client.connection() as conn: auth = geode_client.AuthClient(conn) session = await auth.login("alice", "secure_password") return session </code></pre></div>Certificate-Based Authentication: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">client = geode_client.Client( host="localhost", port=3141, ca_cert="/path/to/ca.crt", client_cert="/path/to/client-cert.pem", client_key="/path/to/client-key.pem", ) </code></pre></div>Token-Based Authentication: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">async def login_and_store_token(): client = geode_client.open_database("quic://localhost:3141") async with client.connection() as conn: auth = geode_client.AuthClient(conn) session = await auth.login("alice", "secure_password") return session.token </code></pre></div> <h4 id="managing-users" class="position-relative d-flex align-items-center group"> Managing Users <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="managing-users" aria-haspopup="dialog" aria-label="Share link: Managing Users"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create user CREATE USER alice WITH PASSWORD 'secure_password'; -- Grant roles GRANT ROLE analyst TO USER alice; -- Revoke roles REVOKE ROLE analyst FROM USER alice; -- Drop user DROP USER alice; </code></pre></div> <h4 id="password-policies" class="position-relative d-flex align-items-center group"> Password Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="password-policies" aria-haspopup="dialog" aria-label="Share link: Password Policies"> Share link </button> </h4>Configure password requirements for security: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml security: password_policy: min_length: 12 require_uppercase: true require_lowercase: true require_digits: true require_special_chars: true max_age_days: 90 prevent_reuse: 5 </code></pre></div> <h3 id="authorization" class="position-relative d-flex align-items-center group"> Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization" aria-haspopup="dialog" aria-label="Share link: Authorization"> Share link </button> </h3> <h4 id="role-based-access-control-rbac" class="position-relative d-flex align-items-center group"> Role-Based Access Control (RBAC) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-based-access-control-rbac" aria-haspopup="dialog" aria-label="Share link: Role-Based Access Control (RBAC)"> Share link </button> </h4>Define roles with specific privileges: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create role CREATE ROLE analyst; -- Grant privileges GRANT SELECT ON GRAPH analytics TO ROLE analyst; GRANT INSERT, UPDATE ON GRAPH analytics TO ROLE data_engineer; GRANT ALL PRIVILEGES ON GRAPH * TO ROLE admin; -- Grant role to users GRANT ROLE analyst TO USER alice, bob; </code></pre></div>Privilege Types: <ul> <li><code>SELECT</code> - Read data</li> <li><code>INSERT</code> - Create nodes and relationships</li> <li><code>UPDATE</code> - Modify existing data</li> <li><code>DELETE</code> - Remove data</li> <li><code>INDEX</code> - Create and drop indexes</li> <li><code>ADMIN</code> - Administrative operations</li> </ul> <h4 id="row-level-security-rls" class="position-relative d-flex align-items-center group"> Row-Level Security (RLS) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="row-level-security-rls" aria-haspopup="dialog" aria-label="Share link: Row-Level Security (RLS)"> Share link </button> </h4>Implement fine-grained access control with policies that filter data based on user context: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create RLS policy CREATE POLICY user_data_policy ON User FOR SELECT USING (id = current_user_id() OR department = current_user_department()); -- Enable RLS on label ALTER LABEL User ENABLE ROW LEVEL SECURITY; -- Create policy for writes CREATE POLICY user_update_policy ON User FOR UPDATE USING (id = current_user_id()) WITH CHECK (id = current_user_id()); </code></pre></div>Policy Examples: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Multi-tenant isolation CREATE POLICY tenant_isolation ON ALL LABELS USING (tenant_id = current_tenant_id()); -- Hierarchical access (manager sees all reports) CREATE POLICY manager_access ON Employee USING ( id = current_user_id() OR manager_id = current_user_id() OR EXISTS { MATCH (e:Employee {id: current_user_id()})-[:MANAGES*]->(emp:Employee) WHERE emp.id = id } ); -- Time-based access CREATE POLICY business_hours ON SensitiveData USING ( current_time() BETWEEN TIME '09:00:00' AND TIME '17:00:00' AND current_day_of_week() BETWEEN 1 AND 5 ); </code></pre></div>Python client example: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">client = geode_client.open_database("quic://localhost:3141") async with client.connection() as conn: auth = geode_client.AuthClient(conn) await auth.login("alice", "password") # RLS automatically filters results based on policies result, _ = await conn.query(""" MATCH (u:User) RETURN u.name, u.department """) # Alice only sees users she's authorized to view </code></pre></div> <h3 id="encryption" class="position-relative d-flex align-items-center group"> Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption" aria-haspopup="dialog" aria-label="Share link: Encryption"> Share link </button> </h3> <h4 id="transparent-data-encryption-tde" class="position-relative d-flex align-items-center group"> Transparent Data Encryption (TDE) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="transparent-data-encryption-tde" aria-haspopup="dialog" aria-label="Share link: Transparent Data Encryption (TDE)"> Share link </button> </h4>TDE encrypts all database files at rest: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Initialize encryption ./geode init-encryption --key-file /secure/path/master.key # Start server with TDE ./geode serve --tde-enabled --tde-key-file /secure/path/master.key </code></pre></div>TDE protects: <ul> <li>Data files</li> <li>Index files</li> <li>WAL (Write-Ahead Log) files</li> <li>Backup files</li> <li>Temporary files</li> </ul> TDE does NOT protect: <ul> <li>Data in memory</li> <li>Data in transit (use TLS for that)</li> <li>Data in query results sent to clients</li> </ul> <h4 id="field-level-encryption-fle" class="position-relative d-flex align-items-center group"> Field-Level Encryption (FLE) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="field-level-encryption-fle" aria-haspopup="dialog" aria-label="Share link: Field-Level Encryption (FLE)"> Share link </button> </h4>Encrypt specific sensitive fields with application-controlled keys: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">from geode_client import FieldEncryption # Initialize encryption encryption = FieldEncryption(key=encryption_key) # Encrypt data before storing encrypted_ssn = encryption.encrypt("123-45-6789") await client.execute(""" CREATE (p:Person { name: $name, ssn: $ssn }) """, { "name": "Alice", "ssn": encrypted_ssn }) # Decrypt when reading result, _ = await client.query("MATCH (p:Person {name: $name}) RETURN p.ssn", {"name": "Alice"}) ssn = encryption.decrypt(result.rows[0]["p.ssn"]) </code></pre></div>FLE Use Cases: <ul> <li>Social Security Numbers</li> <li>Credit card numbers</li> <li>Health records</li> <li>Personally Identifiable Information (PII)</li> <li>Trade secrets</li> </ul> <h4 id="key-management" class="position-relative d-flex align-items-center group"> Key Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-management" aria-haspopup="dialog" aria-label="Share link: Key Management"> Share link </button> </h4>Best practices for encryption keys: <ol> <li>Never hardcode keys: Store in environment variables or key management systems</li> <li>Use key rotation: Periodically change encryption keys</li> <li>Separate keys by purpose: Different keys for TDE, FLE, backups</li> <li>Hardware Security Modules (HSM): Use HSM for production key storage</li> <li>Backup keys securely: Encrypted backups require corresponding keys</li> </ol> Integration with key management systems: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml security: tde: enabled: true kms_provider: aws_kms kms_key_id: arn:aws:kms:us-east-1:123456789:key/abc-def fle: kms_provider: hashicorp_vault vault_address: https://vault.example.com vault_token_path: /run/secrets/vault-token </code></pre></div> <h3 id="audit-logging" class="position-relative d-flex align-items-center group"> Audit Logging <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="audit-logging" aria-haspopup="dialog" aria-label="Share link: Audit Logging"> Share link </button> </h3>Comprehensive audit logging tracks all database activity for compliance, security monitoring, and forensic analysis. <h4 id="enabling-audit-logs" class="position-relative d-flex align-items-center group"> Enabling Audit Logs <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="enabling-audit-logs" aria-haspopup="dialog" aria-label="Share link: Enabling Audit Logs"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">./geode serve \ --enable-audit-log \ --audit-log-path /var/log/geode/audit.log \ --audit-log-format json </code></pre></div> <h4 id="audit-log-contents" class="position-relative d-flex align-items-center group"> Audit Log Contents <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="audit-log-contents" aria-haspopup="dialog" aria-label="Share link: Audit Log Contents"> Share link </button> </h4>Each entry includes: <ul> <li>Timestamp: When the event occurred</li> <li>User: Who performed the action</li> <li>Action: What was done (query, authentication, authorization check)</li> <li>Result: Success or failure</li> <li>Query: GQL query executed (if applicable)</li> <li>Duration: How long the operation took</li> <li>Client IP: Source of the request</li> <li>Session ID: Unique session identifier</li> </ul> Example audit entry: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json">{ "timestamp": "2026-01-24T10:30:45.123Z", "event_type": "query_execution", "user": "alice", "client_ip": "192.168.1.100", "session_id": "sess_abc123", "query": "MATCH (u:User) WHERE u.department = 'Engineering' RETURN u.name", "parameters": {"department": "Engineering"}, "result": "success", "rows_returned": 42, "duration_ms": 15, "rls_policies_applied": ["tenant_isolation", "department_access"] } </code></pre></div> <h4 id="querying-audit-logs" class="position-relative d-flex align-items-center group"> Querying Audit Logs <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="querying-audit-logs" aria-haspopup="dialog" aria-label="Share link: Querying Audit Logs"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- View recent failed authentication attempts SELECT timestamp, user, client_ip, error_message FROM system.audit_log WHERE event_type = 'authentication' AND result = 'failure' AND timestamp > current_timestamp() - INTERVAL '24' HOUR ORDER BY timestamp DESC; -- Identify users accessing sensitive data SELECT user, COUNT(*) AS access_count FROM system.audit_log WHERE query LIKE '%SensitiveData%' AND timestamp > current_timestamp() - INTERVAL '7' DAY GROUP BY user ORDER BY access_count DESC; </code></pre></div> <h3 id="compliance" class="position-relative d-flex align-items-center group"> Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance" aria-haspopup="dialog" aria-label="Share link: Compliance"> Share link </button> </h3> <h4 id="gdpr-compliance" class="position-relative d-flex align-items-center group"> GDPR Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="gdpr-compliance" aria-haspopup="dialog" aria-label="Share link: GDPR Compliance"> Share link </button> </h4>Geode provides features to support GDPR requirements: Right to Access: Export all data for a specific user <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">MATCH (u:User {id: $user_id})-[r]-(related) RETURN u, r, related </code></pre></div>Right to Erasure (Right to be Forgotten): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Delete user and all related data MATCH (u:User {id: $user_id}) DETACH DELETE u </code></pre></div>Data Minimization: Use RLS to limit data access to what’s necessary Consent Management: Track and enforce consent <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE (u:User {id: 123, email: 'alice@example.com'}) CREATE (c:Consent { user_id: 123, purpose: 'marketing', granted: true, timestamp: current_timestamp() }) -- Check consent before processing MATCH (u:User {id: $user_id})-[:HAS_CONSENT]->(c:Consent {purpose: 'marketing'}) WHERE c.granted = true RETURN u </code></pre></div>Data Retention: Automatically delete old data <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Delete data older than retention period MATCH (d:Data) WHERE d.created < current_timestamp() - INTERVAL '7' YEAR DELETE d </code></pre></div> <h4 id="hipaa-compliance" class="position-relative d-flex align-items-center group"> HIPAA Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hipaa-compliance" aria-haspopup="dialog" aria-label="Share link: HIPAA Compliance"> Share link </button> </h4>For healthcare applications: <ul> <li>Encryption: TDE and FLE for Protected Health Information (PHI)</li> <li>Audit Logging: Comprehensive access logs</li> <li>Access Controls: RLS for minimum necessary access</li> <li>Data Integrity: ACID guarantees prevent unauthorized modifications</li> </ul> <h4 id="soc-2-compliance" class="position-relative d-flex align-items-center group"> SOC 2 Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="soc-2-compliance" aria-haspopup="dialog" aria-label="Share link: SOC 2 Compliance"> Share link </button> </h4>Geode supports SOC 2 requirements: <ul> <li>Security: Encryption, authentication, authorization</li> <li>Availability: High availability configurations, backup/restore</li> <li>Processing Integrity: ACID transactions, checksums</li> <li>Confidentiality: Encryption, access controls</li> <li>Privacy: RLS, data retention policies</li> </ul> <h3 id="security-best-practices" class="position-relative d-flex align-items-center group"> Security Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-best-practices" aria-haspopup="dialog" aria-label="Share link: Security Best Practices"> Share link </button> </h3> <h4 id="production-deployment" class="position-relative d-flex align-items-center group"> Production Deployment <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="production-deployment" aria-haspopup="dialog" aria-label="Share link: Production Deployment"> Share link </button> </h4><ol> <li>Enable TLS: Always use encrypted connections</li> <li>Use strong passwords: Enforce password policies</li> <li>Principle of least privilege: Grant minimum necessary permissions</li> <li>Enable audit logging: Track all database activity</li> <li>Regular backups: Encrypted backups stored securely</li> <li>Update promptly: Apply security patches quickly</li> <li>Network isolation: Use firewalls and private networks</li> <li>Monitor continuously: Alert on suspicious activity</li> </ol> <h4 id="development-best-practices" class="position-relative d-flex align-items-center group"> Development Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="development-best-practices" aria-haspopup="dialog" aria-label="Share link: Development Best Practices"> Share link </button> </h4><ol> <li>Never commit secrets: Use environment variables or secrets management</li> <li>Use parameterized queries: Prevent GQL injection</li> <li>Validate input: Sanitize all user input</li> <li>Handle errors securely: Don’t expose sensitive information in error messages</li> <li>Test security: Include security testing in CI/CD</li> <li>Review dependencies: Keep client libraries updated</li> <li>Document security architecture: Maintain security documentation</li> </ol> <h4 id="query-security" class="position-relative d-flex align-items-center group"> Query Security <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="query-security" aria-haspopup="dialog" aria-label="Share link: Query Security"> Share link </button> </h4>Prevent GQL injection by using parameters: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># UNSAFE - vulnerable to injection user_input = request.form["name"] query = f"MATCH (u:User {{name: '{user_input}'}}) RETURN u" await client.execute(query) # SAFE - uses parameters await client.execute( "MATCH (u:User {name: $name}) RETURN u", {"name": user_input} ) </code></pre></div> <h3 id="incident-response" class="position-relative d-flex align-items-center group"> Incident Response <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="incident-response" aria-haspopup="dialog" aria-label="Share link: Incident Response"> Share link </button> </h3> <h4 id="detecting-security-issues" class="position-relative d-flex align-items-center group"> Detecting Security Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="detecting-security-issues" aria-haspopup="dialog" aria-label="Share link: Detecting Security Issues"> Share link </button> </h4>Monitor for: <ul> <li>Repeated failed authentication attempts</li> <li>Unusual query patterns</li> <li>Access to sensitive data outside normal hours</li> <li>Large data exports</li> <li>Privilege escalation attempts</li> </ul> <h4 id="responding-to-incidents" class="position-relative d-flex align-items-center group"> Responding to Incidents <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="responding-to-incidents" aria-haspopup="dialog" aria-label="Share link: Responding to Incidents"> Share link </button> </h4><ol> <li>Isolate: Disconnect affected systems</li> <li>Investigate: Review audit logs</li> <li>Contain: Revoke compromised credentials</li> <li>Remediate: Patch vulnerabilities</li> <li>Recover: Restore from clean backups if needed</li> <li>Document: Record incident details</li> <li>Learn: Update security policies</li> </ol> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/authentication/" >Authentication</a> - User authentication methods</li> <li><a href="/tags/encryption/" >Encryption</a> - Data encryption techniques</li> <li><a href="/tags/row-level-security/" >Row-Level Security</a> - Fine-grained access control</li> <li><a href="/tags/audit-logging/" >Audit Logging</a> - Activity tracking</li> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory requirements</li> <li><a href="/tags/tde/" >TDE</a> - Transparent Data Encryption</li> <li><a href="/tags/fle/" >FLE</a> - Field-Level Encryption</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li><a href="/docs/architecture/security-architecture/" >Security Architecture</a> - Detailed security design</li> <li><a href="/docs/deployment/deployment-patterns/" >Deployment Patterns</a> - Production deployment and hardening</li> <li><a href="/guides/backup-restore/" >Backup and Restore</a> - Secure backup practices</li> <li><a href="/docs/security/overview/" >Security Overview</a> - Security features and best practices</li> </ul>

Popular

Related Articles

Security and Compliance Guide