Security Starts with the Data

Atomic Fusion protects streaming data with authenticated encryption, per-stream encryption keys, and a distributed storage architecture that keeps plaintext and key material out of the storage fleet. Security isn't simply layered on top of the infrastructure; it's built into how data is encrypted, stored, and accessed.

Review Architecture

Secure Connections. Standard Authentication.

Connect your existing Kafka clients securely using TLS and SASL/PLAIN authentication.

  • TLS

    Encrypted Connections

    Secure Kafka client connections.

  • SASL/PLAIN

    Authentication

    Standard credential-based authentication, supported by all Kafka clients.

  • 190-bit

    Password Entropy

    Every credential is securely generated using a CSPRNG.

  • PBKDF2

    Password Protection

    Passwords are protected internally with a key derivation function.

Data Protected Where It's Stored

Fusion encrypts stream contents directly in its storage-record format. Storage nodes handle encrypted record data without access to plaintext payloads or encryption keys, while authenticated encryption protects record integrity.

  • Encryption Built Into Every Stream

    • Fusion encrypts stream contents using AES-256-GCM-SIV, an authenticated encryption algorithm that protects confidentiality and integrity while providing resistance to accidental nonce reuse.
    • Encryption is incorporated directly into the storage-record format, independently of infrastructure-level protections.

  • Storage Never Sees Your Plaintext

    • Fusion fundamentally separates the systems that process data from those that store it.
    • Kafka-compatible brokers perform encryption and decryption, while the distributed storage fleet operates exclusively on encrypted payloads.
    • Storage nodes never receive encryption keys and never handle plaintext record data.
    • This separation reduces the exposure of sensitive information within the storage infrastructure and makes the boundary between trusted processing and persistent storage explicit.

  • Integrity Is Fundamental

    • Confidentiality alone isn't enough; data integrity matters just as much.
    • Fusion's authenticated encryption detects unauthorized modification of record contents, while additional checksums help identify accidental storage corruption.
    • Together, these mechanisms provide complementary protections for data integrity.

Build on a Secure Foundation

Fusion combines authenticated encryption, per-stream keys, and ciphertext-only distributed storage with the performance and durability of a purpose-built streaming architecture.

Explore Reliability