Security

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/managed-postgres/security.md)

[Private preview](https://clickhouse.com/cloud/postgres)

Managed Postgres is built with enterprise-grade security features to protect your data and meet compliance requirements. This page covers network security, encryption, and backup retention policies.

## IP whitelisting[​](#ip-whitelisting "Direct link to IP whitelisting")

IP filters control which source IP addresses are permitted to connect to your Managed Postgres instance, providing network-level access control to protect your database from unauthorized connections.

### Configuring IP filters[​](#configuring-ip-filters "Direct link to Configuring IP filters")

For detailed information on configuring IP filters, see the [Settings](/docs/cloud/managed-postgres/settings#ip-filters) page.

You can specify:

- Individual IP addresses (e.g., `203.0.113.5`)
- CIDR ranges for networks (e.g., `192.168.1.0/24`)
- **Anywhere** to allow all IP addresses (not recommended for production)
- **Nowhere** to block all connections

Production best practices

If no IP filters are configured, connections from all IP addresses are permitted. For production workloads, restrict access to known IP addresses or CIDR ranges. Consider limiting access to:

- Your application servers
- VPN gateway IP addresses
- Bastion hosts for administrative access
- CI/CD pipeline IPs for automated deployments

## Encryption[​](#encryption "Direct link to Encryption")

Managed Postgres encrypts your data both at rest and in transit to ensure comprehensive data protection.

### Encryption at rest[​](#encryption-at-rest "Direct link to Encryption at rest")

All data stored by Managed Postgres is encrypted at rest to protect against unauthorized access to the underlying storage infrastructure.

#### NVMe storage encryption[​](#nvme-encryption "Direct link to NVMe storage encryption")

Your database files, transaction logs, and temporary files stored on NVMe drives are encrypted using industry-standard encryption algorithms. This encryption is transparent to your applications and requires no configuration.

#### Object storage encryption (S3)[​](#s3-encryption "Direct link to Object storage encryption (S3)")

Backups and Write-Ahead Log (WAL) archives stored in object storage are also encrypted at rest. This includes:

- Full daily backups
- Incremental WAL archives
- Point-in-time recovery data

All backup data is stored in dedicated, isolated storage buckets with credentials scoped to each individual instance, ensuring that backup data remains secure and accessible only to authorized systems.

References

Encryption at rest is enabled by default for all Managed Postgres instances and can't be disabled. No additional configuration is required.

### Encryption in transit[​](#encryption-in-transit "Direct link to Encryption in transit")

All network connections to Managed Postgres are secured using TLS (Transport Layer Security) to protect data as it moves between your applications and the database.

#### TLS/SSL configuration[​](#tls-ssl "Direct link to TLS/SSL configuration")

By default, connections use TLS encryption without certificate verification. For production workloads, we recommend connecting with verified TLS to ensure you're communicating with the correct server.

For more details on TLS configuration and connection options, see the [Connection](/docs/cloud/managed-postgres/connection#tls) page.

## Private Link[​](#private-link "Direct link to Private Link")

Private Link enables private connectivity between your Managed Postgres instance and your Virtual Private Cloud (VPC) without exposing traffic to the public internet. This provides an additional layer of network isolation and security.

Manual setup required

Private Link support is available but requires manual configuration by ClickHouse support. This feature is ideal for enterprise customers with strict network isolation requirements.

### Requesting Private Link setup[​](#requesting-private-link "Direct link to Requesting Private Link setup")

To enable Private Link for your Managed Postgres instance:

1. **Contact ClickHouse support** by creating a support ticket
2. **Provide the following information**:

   - Your ClickHouse organization ID
   - ID/hostname of postgres service
   - AWS account IDs/ARNs which you'd like to connect the private link with
     - (Optional) Any regions other than the Postgres instance region you'd like to connect from
3. **ClickHouse support will**:

   - Provision the Private Link endpoint on the Managed Postgres side
   - Provide you with endpoint connection details which you can use to create an endpoint interface.
4. **Setup your Private Link**:

   - Create the Private Link by heading over to endpoint interface in AWS settings and using the configuration provided by the ClickHouse support.
   - Once your Private Link is in an "Available" state, you can connect to it by using the Private DNS name provided in the AWS UI.

## Backup retention[​](#backup-retention "Direct link to Backup retention")

Managed Postgres automatically backs up your data to protect against accidental deletion, corruption, or other data loss scenarios.

### Retention policy[​](#retention-policy "Direct link to Retention policy")

- **Default retention period**: 7 days
- **Backup frequency**: Daily full backups + continuous WAL archiving (every 60 seconds or 16 MB, whichever comes first)
- **Recovery granularity**: Point-in-time recovery to any moment within the retention window

### Backup security[​](#backup-security "Direct link to Backup security")

Backups are stored with the same security guarantees as your primary data:

- **Encryption at rest** in object storage
- **Isolated storage buckets** per instance with scoped credentials
- **Access control** limited to the Postgres Instance linked to the backup.

For more details on backup strategies and point-in-time recovery, see the [Backup and restore](/docs/cloud/managed-postgres/backup-and-restore) page.

- [IP whitelisting](#ip-whitelisting)
  - [Configuring IP filters](#configuring-ip-filters)- [Encryption](#encryption)
    - [Encryption at rest](#encryption-at-rest)- [Encryption in transit](#encryption-in-transit)- [Private Link](#private-link)
      - [Requesting Private Link setup](#requesting-private-link)- [Backup retention](#backup-retention)
        - [Retention policy](#retention-policy)- [Backup security](#backup-security)

Was this page helpful?