Security built for cultural heritage data

Madrona is open source, so security review does not depend on trusting us — your IT team can read the code. On our hosting we run it on AWS with encryption, managed authentication, and complete audit logging. Self-hosted, the application controls are identical and the infrastructure is yours.

Request security documentation

Hosted and self-hosted are not identical

These are the differences that matter for a security review. Everything not listed here is the same code in both cases.

Concern	Madrona hosting	Self-hosted default
Authentication	AWS Cognito, with SSO/SAML available	Local password auth (bcrypt), or point it at your own identity provider
Multi-factor auth	TOTP, SMS, and email factors via Cognito	Not available in the local auth provider — put the app behind your own SSO or VPN
Object storage	Amazon S3, or your own bucket	MinIO in the compose stack, or any S3-compatible store
Backups	Automated, with point-in-time recovery	Yours to run — pg_dump plus the object storage volume
Email	Amazon SES	Your SMTP server; disabled by default, which logs invite links instead of sending them
Updates and patching	We apply them	You pull and redeploy on your own schedule

Authentication

Madrona hosting

AWS Cognito, with SSO/SAML available

Self-hosted default

Local password auth (bcrypt), or point it at your own identity provider

Multi-factor auth

Madrona hosting

TOTP, SMS, and email factors via Cognito

Self-hosted default

Not available in the local auth provider — put the app behind your own SSO or VPN

Object storage

Madrona hosting

Amazon S3, or your own bucket

Self-hosted default

MinIO in the compose stack, or any S3-compatible store

Backups

Madrona hosting

Automated, with point-in-time recovery

Self-hosted default

Yours to run — pg_dump plus the object storage volume

Madrona hosting

Amazon SES

Self-hosted default

Your SMTP server; disabled by default, which logs invite links instead of sending them

Updates and patching

Madrona hosting

We apply them

Self-hosted default

You pull and redeploy on your own schedule

Infrastructure (Madrona hosting)

AWS hosted

Deployed on Amazon Web Services with automated health checks and recovery procedures.

Encryption in transit

All data encrypted via TLS between your browser and our servers.

Encryption at rest

Database and file storage encrypted via AWS-managed AES-256 encryption.

Automated backups

Database backups with point-in-time recovery. Stored separately from production data.

Search infrastructure

OpenSearch powers full-text search and faceted filtering across collections and media.

Background processing

Asynchronous workers handle media derivatives, data pipelines, and scheduled tasks.

Authentication & access controls

Role-based access control

Granular permissions at the field level. Define exactly who can view and edit what across the platform. Identical in both deployments.

Audit logging

Every data change logged with user identity, timestamp, and before/after values. Audit records are restricted from modification in the application layer and can be exported. Identical in both deployments.

Row-level tenant isolation

Isolation is enforced by PostgreSQL row-level security at the database layer, not by application code that could forget to filter. Identical in both deployments.

Secure session handling

Short-lived access tokens with refresh tokens held in HttpOnly cookies and hashed at rest. No tokens in browser storage.

Managed authentication (hosting)

On our hosting, user authentication is managed by AWS Cognito with multi-factor authentication and SSO/SAML support.

Local authentication (self-hosted)

A self-hosted stack defaults to local password authentication with bcrypt hashing. The local provider does not implement MFA — front it with your own SSO or VPN if you need a second factor.

Data protection & portability

Auditable by construction

The platform is Apache-2.0 and the source is public. Your IT team can review authentication, access control, and audit code directly instead of relying on a vendor questionnaire.

Data portability

Full data export in JSON, CSV, and JSON-LD formats. Your data is always yours.

Tenant isolation

Multi-tenant architecture with row-level security. Each organization's data is logically isolated.

Vendor assessments

We respond to security questionnaires and provide architecture documentation for procurement review.

Data sovereignty

Run it entirely in-house

The strongest sovereignty guarantee we offer is that you do not need us. The full stack runs on your own hardware with docker compose and no outbound cloud dependency.

Bring your own storage

Connect your own S3, Azure Blob Storage, Google Cloud Storage, or MinIO bucket. Media files are stored directly in infrastructure you control.

Region selection

On our hosting, choose the AWS region where your data is stored. Available regions include US, Canada, Europe, and Asia-Pacific.

Managed migration

Migrate existing media to your own bucket with incremental transfers, parallel processing, and integrity verification.

Custom CDN

Serve media through your own CDN domain with signing key support for access control.

Questions about security?

We provide security documentation for procurement and vendor assessments. Reach out to discuss your requirements.