Secure Every Deployment

Security controls are available across all Qdrant Cloud deployment modes. Hybrid Cloud and Private Cloud add full data isolation for stricter residency and compliance requirements.

Explore the Security Docs Start Free

What Security You Get on Each Deployment Model

Qdrant Cloud

Hybrid / Private Cloud

Self-Hosted

Encryption in transit (TLS)

Built-in

Customer configuration

Encryption at rest

Built-in; Customer-provided keys (Premium)

Customer configuration

Audit Logging

Available on paid clusters

Customer configuration

Cloud Management Console role-based access control (RBAC)

Built-in

Built-in, Hybrid only

Not applicable

Single sign-on (SSO)

Premium add-on

Premium add-on
(Hybrid only)

Not applicable

VPC PrivateLink

Premium add-on

Not applicable

Compliance documentation (SOC 2 Type 2, HIPAA)

Available via Trust Center

Not applicable

Data Access Isolation and Encryption

For Qdrant Cloud, customers can expect:

Cluster Isolation

Hardened, unprivileged containers, isolated from one another.

Explore Cluster Isolation

Encryption in Transit, at Rest

Data protected in transit with TLS and storage volumes encrypted at rest. Premium customers can encrypt their data at rest using their own keys.

See How Encryption Works

Telemetry and Logs

Originate from Qdrant cluster, but then are pushed to Qdrant's US management plane.

Monitor Your Clusters

In-region Data Residency

Data in Qdrant clusters stored only in the cluster's deployment region.

Choose Your Region

Compliance and Certifications

Qdrant holds SOC 2 Type 2 and HIPAA certifications. Pull compliance reports directly from the Trust Center. For deployments subject to GDPR, Qdrant provides a Data Processing Agreement covering data protection and privacy commitments. Contact Qdrant to discuss Personal Health Information (PHI) data handling requirements for your deployment.

Request Reports in the Trust Center

Audit Logging

Audit logging, available on paid clusters, captures operations performed through the Qdrant API, including user and API key attribution, timestamp, target collection, and result of the action.

Activate Audit Logging

ONLY AVAILABLE ON PREMIUM TIER

Network Isolation and Private Connectivity

Connect your Qdrant Managed Cloud cluster to your VPC using private links, so traffic between your application and the cluster travels over your private network. Private link connectivity is available to Premium customers.

Learn About Private Connectivity

ONLY AVAILABLE ON PREMIUM TIER

Single Sign-On

Qdrant Cloud supports enterprise SSO for Premium tier customers, with support for Active Directory/LDAP, ADFS, Azure Active Directory Native, Google Workspace, OpenID Connect, Okta, PingFederate, and SAML.

Set Up SSO

Access Control and RBAC

Qdrant Cloud lets you manage permissions for cloud resources at the collection-level inside the Qdrant Cloud Management Cloud Console.

Configure RBAC

Across All Deployment Modes, Here Is What Qdrant Can Access

Qdrant Cloud

Hybrid Cloud

Private Cloud

Infrastructure metrics
(CPU, memory, disk)

Visible to Qdrant

Not Visible to Qdrant

Cluster metadata
(names, labels, collections)

Visible to Qdrant

Not Visible to Qdrant

Vectors, payloads, queries

Stays in your cluster

Database, stored data, API keys, backups, logs

Qdrant Infrastructure

Your infrastructure, no Qdrant access

Integrated management and observability

Available

Not available (airgapped)

FAQs

Does Qdrant access my data on Qdrant Managed Cloud?

On Qdrant Cloud, every storage volume is encrypted at rest. Qdrant does not access any data stored in Qdrant clusters. API keys are stored securely as hashes. The data isolation guarantee covering the database, stored data, API keys, backups, and cluster logs applies to Hybrid Cloud and Private Cloud. Contact Qdrant if your requirements call for that level of isolation.

Which controls does a Premium tier account provide?

PrivateLink (private VPC connectivity), enterprise SSO, and customer-managed encryption keys (BYOK) are all available to Premium tier customers. Contact Qdrant to enable any of these for your account.

Which identity providers does Qdrant Cloud SSO support?

Qdrant Cloud enterprise SSO supports Active Directory/LDAP, ADFS, Azure Active Directory Native, Google Workspace, OpenID Connect, Okta, PingFederate, and SAML. SSO is available as an add-on for Premium tier customers.

How do API keys work and can I scope them to specific collections?

Api keys default to cluster-wide manage/write permissions, with a read-only option also available. To restrict a key to a subset of collections, select the Collections tab and choose the relevant collections. Set an expiration in days (default is 90) and rotate keys regularly.

How does Hybrid Cloud address data residency requirements?

Hybrid Cloud provides a similar developer and ops experience to Qdrant Managed Cloud through the Qdrant Cloud console, while keeping the data plane inside your own infrastructure. Qdrant sees only infrastructure metrics in this mode; the database, stored data, API keys, backups, and cluster logs remain inside your infrastructure.

What certifications does Qdrant hold?

Qdrant holds SOC 2 Type 2 and HIPAA certifications. Pull reports from the Trust Center. For certifications or frameworks not listed there, contact Qdrant directly.

Can Qdrant sign a BAA for PHI workloads?

Qdrant is HIPAA certified and Business Associate Agreement is available for Qdrant Managed Cloud. For specific PHI handling requirements, contact Qdrant to discuss your situation.

Secure Every Deployment