Skip to content
← All use cases

A sovereign, portable lakehouse

Keep your data in open tables, in your region, under your keys.

Tables in open Iceberg format on the storage you choose, encrypted with your own tenant keys, held in the regions your policy allows, governed at query time, and exportable whole when you leave.

For Data, Platform, Compliance

Download the brief(PDF)

Start freeTalk to us
Data workspace
The logistics.shipments table in the data workspace: its columns and types, its classification and row count, and the snapshot that is current.The logistics.shipments table in the data workspace: its columns and types, its classification and row count, and the snapshot that is current.
One Iceberg table: schema, properties and the snapshot history. Shown with demo data.

The situation

The data platform is a vendor’s format in a vendor’s region. Residency is a promise in a contract, encryption keys are theirs, and leaving means a migration project nobody wants to fund.

How it works

Step by step, and the product each step happens in.

  1. 01

    Store tables in an open format

    Iceberg tables behind a standards-compatible REST catalog, on S3-compatible storage over MinIO or native buckets.

    In Lakehouse
    Data workspace
    The logistics.shipments table in the data workspace: its columns and types, its classification and row count, and the snapshot that is current.The logistics.shipments table in the data workspace: its columns and types, its classification and row count, and the snapshot that is current.
    One Iceberg table: schema, properties and the snapshot history. Shown with demo data.

  2. 02

    Encrypt with your own keys

    Data at rest is encrypted with per-tenant keys, and sensitive columns can be encrypted on their own.

    In Lakehouse

  3. 03

    Keep it where it must stay

    Residency policies per tenant and classification decide which substrates data may live on, enforced at the decision point.

    In the Data platform

  4. 04

    Govern every query

    Row and column rules are applied in the query plan, so the editor, dashboards, BI tools and the API return the same narrowed answer.

    In SQL & Analytics

  5. 05

    Leave with everything

    A tenant export takes your data and configuration out with no lock-in.

    In Trust and security

What you get

  • No proprietary format

    Any engine that reads Iceberg can read your tables, and an export takes everything with you.

  • Residency enforced, not promised

    Where data may live is a policy the platform checks, per tenant and classification.

  • History you can query

    Time travel by timestamp or snapshot, and branches you can roll back.

The products involved

Questions, answered

Can we bring our own storage?

Yes. The lakehouse stores tables on S3-compatible object storage, over MinIO or native buckets.

Who holds the keys?

Encryption at rest uses per-tenant keys, with column-level encryption for the most sensitive fields.

Related use cases

A sovereign, portable lakehouse · ProjectX