Secrets Management
How Solid stores, protects, and manages the credentials you provide during connector setup — what's stored, where, and what controls are in place.
When you configure a data connector in Solid, you provide credentials for a read-only service account — a password, a service account key, or a client secret. This page explains how Solid handles those credentials.
What Solid stores
Solid stores the credentials needed to connect to each configured data source:
- Database usernames and passwords (for Snowflake, SQL Server, Oracle, Redshift, Db2, Teradata)
- Service account keys or JSON credentials (for BigQuery)
- Client IDs, client secrets, and tenant IDs (for Power BI, Azure-based integrations)
- API keys or client certificates (for Qlik Sense, Tableau, Looker)
Solid does not store warehouse result data, query outputs, or any content from your actual tables. Only connection credentials are stored.
Where credentials are stored
Solid stores credentials in Azure Key Vault — a managed secrets service with hardware security module (HSM) backing. Key Vault is the production secret store for all Solid SaaS deployments.
All data at rest in Solid — including stored credentials — is encrypted using Customer-Managed Keys (CMK). See Security Architecture for the full encryption model.
Migration to AWS Secrets Manager: Solid's private cloud deployments on AWS are in the process of migrating credential storage to AWS Secrets Manager. Functionality is equivalent; the underlying store differs. If your deployment is AWS-based, your Solid team can confirm which secret store your environment uses.
Encryption and transit security
| Layer | Control |
|---|---|
| At rest | Encrypted via Customer-Managed Keys (CMK) through Azure Key Vault |
| In transit | All traffic secured via TLS 1.2+ |
| Key management | Azure Key Vault handles key lifecycle and HSM-backed storage |
Credential rotation
Solid supports manual credential rotation — when you rotate a service account password or API key on the warehouse side, update the corresponding connector credential in Solid's UI to keep the connection active.
Automatic application-level credential rotation is on the product roadmap. Azure Key Vault provides automatic certificate rotation for Solid's own infrastructure certificates; rotation of customer-provided connector credentials (your service account passwords and API keys) is currently manual.
Tenant isolation
Each customer's credentials are stored and accessed in isolation — Solid's authorization model ensures that one tenant's secrets cannot be retrieved in the context of another tenant's requests. Cross-tenant credential access is not possible by design.
Private Cloud deployments
In Private Cloud deployments, Solid runs entirely within your own cloud environment. Credential storage uses the same Key Vault or Secrets Manager mechanism, but the vault itself is provisioned inside your own subscription — you retain full control of the key material and audit logs.
Questions
For questions about secrets management practices for your specific deployment, contact [email protected].
Updated 10 days ago