Skip to main content

Security Model

DoubleDino runs entirely inside your infrastructure.

Your production data does not need to leave your network. DoubleDino connects to the configured source, transforms data inside the process, and only returns or writes the transformed result.

Security boundary​

Your organisation controls the environment in which DoubleDino runs, including:

  • Network access.
  • Source permissions.
  • API access.
  • Infrastructure security.
  • Log access and retention.

DoubleDino does not operate as an external data-processing service.

Proxy mode​

Proxy mode provides read-only access to the configured source.

Queries are executed against the source and the results are transformed before they are returned to the client.

DoubleDino does not write to the source.

Source → DoubleDino → Transform → Client

Clone mode​

Clone mode reads from the source, transforms the data, and writes the transformed result to the destination.

The source is not modified.

Source → DoubleDino → Transform → Destination

The destination contains transformed values while retaining the structure and relationships required to work with the data.

Authentication​

Proxy requests require the configured DD_AUTH_KEY:

x-api-key: your-api-key

DoubleDino does not manage user accounts or identity. API key distribution and access control remain the responsibility of your infrastructure.

Transformation key​

DD_SECRET_KEY controls deterministic transformation.

The same key produces the same transformed output for the same input. This allows relationships and repeated values to remain consistent.

Protect the key as an infrastructure secret.

Changing the key produces different transformed values.

Logs​

DoubleDino writes logs to standard output and standard error.

Your infrastructure controls log collection, storage, retention, and access.

See Logging.

Responsibility​

DoubleDino provides the data transformation boundary. It does not replace your existing security controls.

Your organisation remains responsible for:

  • Source permissions.
  • Network controls.
  • API access.
  • Infrastructure security.
  • Log access.

DoubleDino is designed to reduce exposure of original production values while keeping production data useful for development and debugging.