KNIME Documentation

Security and compliance ​

Knime runs in a Knime-managed cloud account on AWS or Azure. Knime handles infrastructure provisioning, upgrades, and security operations. It restricts administrative access to the underlying infrastructure to a small group of authorized Knime operations personnel under strict role-based controls, and every access is logged and auditable.

The platform is ISO 27001 certified and aligned with GDPR, Swiss FADP, and UK GDPR. Knime runs independent penetration testing at least twice annually and whenever it introduces major changes. Development and deployment follow OWASP ASVS and Secure Coding Practices.

Encryption ​

Knime encrypts your data both in transit and at rest.

All traffic between you, your instance, and connected systems is protected with TLS 1.2 or higher, so workflows, files, API calls, and data-app interactions can't be read or modified in flight.

At rest, all data is encrypted using AES-256:

  • Object storage holding workflows, components, files, models, and space data is protected with server-side encryption (SSE-S3 on AWS, Storage Service Encryption on Azure)
  • The managed Postgres database is encrypted at the volume level
  • Persistent disks and snapshots used for backups and replication are likewise AES-256 encrypted

Encryption keys are managed by the cloud provider's key management service, with automatic key rotation. Traffic that flows over the Private Connect add-on, using AWS PrivateLink or Azure Private Link, stays on the cloud provider's internal network. It's also TLS-encrypted end to end. See Custom VPC and Private Link for details.

Access control model ​

Role-based access control governs who can view, edit, or execute content in Knime. Permissions are granted through team membership and managed at the space level. Credentials needed by workflows are held in a managed secret store rather than embedded in workflow files. See Types of admin roles for the full role model.

Logging and monitoring ​

Knime continuously monitors your instance's infrastructure, and every administrative access to your data is logged and auditable. See Audit trails for what's logged and what you can monitor yourself.