Handling GDPR erasure requests in ClickHouse
Deleting a data subject's rows from ClickHouse in a provable time: lightweight DELETE versus ALTER DELETE, forcing physical removal, backups and replicas, and designing tables so erasure is cheap.
ClickHouse compliance
Meeting GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, DORA and NIS2 requirements with self-managed ClickHouse: erasure, retention, audit logs, access control, encryption and backups.
Audit logging in ClickHouse with query_log and session_log
Building an audit trail from ClickHouse system tables: who logged in, what they queried, retention and export to a SIEM, and masking sensitive values in the logs.
Running ClickHouse for HIPAA-regulated data
Mapping HIPAA Security Rule safeguards to self-managed ClickHouse: access control, audit controls, encryption at rest and in transit, backups, and keeping PHI out of logs.
ClickHouse in PCI DSS cardholder data environments
Keeping ClickHouse in or out of PCI DSS scope: storing tokens instead of card numbers, encryption, masking rules for logs, access reviews and audit trails.
ClickHouse evidence for SOC 2 audits
The evidence a self-managed ClickHouse cluster produces for SOC 2: access reviews, change records for upgrades, backup and restore tests, monitoring and incident logs.
ClickHouse controls for ISO 27001
Mapping ISO 27001 Annex A controls to ClickHouse operations: access control, logging and monitoring, backup, cryptography and secure configuration.
ClickHouse resilience and recovery for DORA
What DORA's ICT risk and resilience requirements mean for a ClickHouse cluster at a financial entity: backup and restore testing, recovery objectives, incident logging and exit from managed services.
ClickHouse security measures for NIS2
Applying NIS2 risk management measures to self-managed ClickHouse: patching on supported versions, access control, encryption, backups and incident detection.
EU data residency with self-managed ClickHouse
Keeping analytical data inside the EU by running ClickHouse in your own infrastructure: where data, backups and object storage live, operator access, and what a managed service changes.
