Redpanda Cloud Security Overview
Security reviews of a managed streaming platform raise the same questions: where does the data live, who can access it, how is it encrypted, and which controls belong to you rather than the vendor. This page answers those questions for Redpanda Cloud.
Redpanda Cloud secures every cluster by default. Client connections require authentication and TLS encryption, and Redpanda encrypts data at rest and continuously patches and monitors the platform. You control the identity and access layer: how users sign in, who can access which resources, and how clients reach your clusters over the network.
After reading this page, you will be able to:
-
Describe how Redpanda Cloud secures clusters by default and which security controls you configure yourself
-
Identify which security features apply to your cluster type
-
Locate the detailed documentation for each security capability
Control plane and data plane architecture
Redpanda Cloud separates the systems that manage clusters from the clusters themselves:
-
The control plane is a Redpanda-managed service that provisions, configures, and maintains clusters. You interact with it through the Redpanda Cloud UI and the Control Plane API to create clusters, networks, and resource groups, and to manage organization-level access.
-
The data plane is where your cluster and your streaming data live. With Bring Your Own Cloud (BYOC) clusters, the data plane runs in your own cloud account, and your data never leaves it.
A Redpanda Cloud agent runs in each data plane. The agent authenticates to the control plane with opaque, ephemeral tokens, pulls cluster specifications, and applies them using least-privilege IAM roles. Clusters remain available even if the connection to the control plane is lost. For the full architecture, see BYOC Architecture.
Shared responsibility at a glance
Redpanda secures the platform. You decide who gets in and what they can do.
| Redpanda manages | You manage |
|---|---|
|
|
Some areas are shared, and responsibilities differ by deployment type. For the complete breakdown, see the shared responsibility model. It covers BYOC, Bring Your Own VPC/VNet (BYOVPC/BYOVNet), and Dedicated clusters in detail. For Serverless clusters, Redpanda manages the infrastructure end to end, and you manage user access, ACLs, and your data.
Security capabilities
Each capability in this section links to the documentation that covers configuration details.
Authentication
Users sign in to Redpanda Cloud with email and password (hashed and salted with bcrypt) or through single sign-on (SSO) with any identity provider that supports OpenID Connect (OIDC). You can enable multi-factor authentication (MFA) for your own account or enforce it for your whole organization.
Applications and services authenticate to cluster APIs with SASL, mTLS (AWS and GCP clusters), or HTTP basic authentication, depending on the API. Redpanda Cloud encrypts all client connections with TLS.
See Authentication.
Authorization
Control access at two levels: organization-level resources in the control plane, and topics, groups, and schemas in the data plane. Use role-based access control (RBAC) to assign users access to specific resources, group-based access control (GBAC) to inherit permissions from your identity provider’s groups, and Kafka ACLs for fine-grained permissions on individual resources. In BYOC deployments, Redpanda Cloud also assigns least-privilege IAM policies to the agent that manages your cluster infrastructure.
See Authorization.
Encryption
Redpanda Cloud encrypts data at rest using the cloud provider’s default volume encryption (AES-256) and encrypts Tiered Storage data with server-side encryption using periodically rotated keys. Redpanda Cloud also encrypts all network traffic carrying customer data in transit with TLS, using certificates issued by Let’s Encrypt.
See Encryption.
Network security
Choose public clusters (internet-accessible endpoints protected by authentication and TLS) or private clusters, which accept connections only through VPC peering or private connectivity services: AWS PrivateLink, Azure Private Link, or GCP Private Service Connect. Redpanda Cloud segments cluster networks by workload type, and brokers in private clusters run in private subnets.
Secrets
Redpanda Cloud favors dynamic credentials through least-privilege IAM roles. It stores static secrets in AWS Secrets Manager or GCP Secret Manager, and those secrets never leave the data plane account or network.
See Secrets.
Audit logging
Record authentication and Kafka resource access events for compliance and incident investigation. Redpanda supports audit logging on BYOC and Dedicated clusters.
See Audit Logging.
Availability and reliability
Deploy BYOC and Dedicated clusters across up to three availability zones with automatic data distribution (rack awareness) and a default replication factor of three. Serverless clusters do not support multiple availability zones. Redpanda upgrades one broker at a time, waiting for the cluster to return to a healthy state between brokers, and Redpanda teams monitor clusters 24/7. Every release passes chaos testing and a certification process on each supported cloud provider, and Redpanda has undergone independent Jepsen validation.
See Availability and Safety and Reliability.
Security by cluster type
Deployment types differ mainly in where the data plane runs and how much of the environment you control:
-
BYOC: The data plane runs in your own cloud account (AWS, Azure, or GCP), so your data stays in your environment. BYOC supports the full security feature set, including mTLS (AWS and GCP), RBAC, GBAC, audit logging, and private networking.
-
BYOVPC/BYOVNet: A BYOC variant where you provide and manage the VPC or VNet, IAM resources, and the Tiered Storage bucket or container that Redpanda services use. This shifts more of the shared responsibility to you and gives you the tightest control over your environment, but the configuration is more complex and it requires Premium support. Standard BYOC already runs the data plane in your own cloud account, so choose BYOVPC/BYOVNet when you need to own the network and IAM lifecycle, not as a prerequisite for a secure deployment.
-
Serverless: Runs on shared infrastructure that Redpanda manages end to end. Connections use SASL authentication over TLS, and you manage access with ACLs. Serverless does not support mTLS for Kafka clients, RBAC in the data plane, GBAC, or multiple availability zones. On AWS, you can enable private connectivity with AWS PrivateLink. See Redpanda Serverless.
-
Dedicated: Single-tenant clusters hosted in Redpanda’s cloud account. See the Redpanda Cloud Overview for details.
