Reltio Data Cloud Security Recommendations
Learn more about security hardening settings and recommendations for Reltio Data Cloud.
Shared responsibility model
Reltio operates and secures the underlying Reltio Context Intelligence Platform infrastructure, including the cloud environments, network perimeter, and platform services described in this document. Many of the controls listed below — for example, enabling single sign-on, enforcing multi-factor authentication, configuring password policy, or subscribing to Reltio Shield or Reltio Private Link — must be actively configured, subscribed to, or operated by the customer. Reltio making a control available does not mean it is enabled or configured to a given standard, without customer action. This table is intended to help customers understand which controls exist, what the default behavior is, and what Reltio recommends configuring.
Explanation of table headings
The following table explains what each column in the security hardening checklist means.
| Heading | What it means |
|---|---|
| Service | The Reltio Data Cloud product, application, or platform area the setting belongs to (for example, Reltio Console, Reltio Hub, or Reltio Platform APIs). |
| Priority | How much a given recommendation reduces risk or improves your security posture if it isn't already in place. See "Explanation of priority" below. |
| Secure Operations Map | The security category the row falls under. |
| Topic | The specific setting, feature, or control being described. |
| Default Setting or Behavior | What the setting or behavior is out of the box, before any customer configuration, unless otherwise noted. |
| Recommendation | What Reltio recommends you do about this setting. |
| Recommendation Type | Whether the recommendation is Technical (something a system administrator configures in the product or via API) or Non-Technical (a customer-side process, policy, or organizational decision). |
| More Information | Link to the published Reltio documentation topic covering this setting in detail. |
Explanation of priority
The following table defines each priority level used in the security hardening checklist.
| Priority | Meaning |
|---|---|
| Critical | The default setting or the absence of this control exposes the system to significant risk, or threatens system reliability, if not addressed. |
| Recommended | Implementing this recommendation improves your security posture and reduces attack surface, even though the default setting does not expose you to a critical risk. |
| Advanced | This recommendation extends security to a higher standard than Reltio's default posture, or addresses organization-specific requirements (for example, regulatory or contractual obligations). |
Security hardening checklist
The following table lists security hardening settings and recommendations across Reltio Data Cloud.
| Service | Priority | Secure Operations Map | Topic | Default Setting or Behavior | Recommendation | Recommendation Type | More Information |
|---|---|---|---|---|---|---|---|
| Reltio Platform — Access Management | Recommended | Identity & Access | Single sign-on (SSO) | New tenants use Reltio-managed native accounts: users sign in with a username and password issued in their Welcome to Reltio email. SSO is not enabled by default; it requires configuration to integrate with your corporate identity provider (IdP). | Configure SSO (OAuth 2.0/OIDC or SAML) so users authenticate against your corporate IdP with a single set of credentials, instead of a separate Reltio-managed password. | Technical | Authenticate with SSO |
| Reltio Platform — Access Management | Recommended | Identity & Access | Multi-factor authentication (MFA) | MFA is enforced by default for all non-SSO users, regardless of which tenant they access, and cannot be disabled. Only the Authenticator (app-based) MFA option can be toggled by an administrator. | Since MFA is enforced by default and can't be disabled, review which second factor your organization uses — app-based (TOTP Authenticator) or email-based code. | Technical | Enable MFA |
| Reltio Platform — Access Management | Critical | Identity & Access | Password policy | The default Reltio password policy applies to all native (non-SSO) users, in every tenant and region, unless a customer administrator overrides it: account lockout after 5 failed login attempts, account lockout after 90 days of inactivity, minimum password length of 10 characters, a 3-password reuse history, at least 1 uppercase letter, 1 lowercase letter, 1 digit, and 1 special character, plus restrictions on alphabetical/numerical/QWERTY sequences and a small dictionary of forbidden strings (for example, "reltio"). | Review the default policy against your organization's requirements. Use the Customer Password Policy API (requires ROLE_ADMIN_CUSTOMER) to strengthen length, complexity, history, and lockout thresholds, and enable userSessionTimeoutSeconds to force idle-session sign-out (coordinate with Reltio Support before enabling, since it also requires IdP-side configuration). | Technical | Customer Password Policy APIs |
| Reltio Console — Security Applications | Recommended | Identity & Access | Client credentials (machine-to-machine authentication) | No Client ID/Client Secret pairs exist until a customer administrator creates them. Without them, a machine-to-machine (M2M) integration would otherwise need to authenticate using a human user's own username and password. | Use Client Credentials (OAuth 2.0 Client ID/Client Secret) for scoped M2M integrations instead of a human user's credentials, and limit who can create or manage them to customer administrators or users with client-management permissions. | Technical | Client Credentials at a glance |
| Reltio Console — Configuration Applications | Advanced | Data Protection | Encryption at rest (Reltio Shield) | Data at rest is encrypted by default, and Reltio creates and manages the encryption key on your behalf. Reltio Shield (customer-managed key / CMK) is an additional subscription — not included by default — and is only supported for tenants on AWS or GCP with DynamoDB as primary storage. | Subscribe to and enable Reltio Shield if your organization needs to generate, rotate, and revoke your own AES-256 encryption keys (CMK) instead of relying on a Reltio-managed key, for example to meet a specific compliance obligation. | Technical | Reltio Shield at a glance |
| Reltio Hub | Recommended | Logging & Monitoring | Activity Log | The Activity Log perspective is populated automatically for every tenant; user activity (logins, profile searches, merges, deletions, and so on) is recorded without any setup. Administrators can view activity for all users, not just their own. | Have administrators periodically review the Activity Log as part of routine access monitoring, rather than only after a suspected incident. | Non-Technical | Activity Log perspective |
| Reltio Platform APIs — User Management API | Recommended | Logging & Monitoring | Security Audit Log API | The API exists and is callable by default, but nothing is pushed anywhere automatically — you must actively query it or integrate it with a downstream tool. Results are filterable by IP address, username, event type, and time range (up to 24 hours per request), and calling it requires the ROLE_ADMIN_CUSTOMER role. | Integrate the Security Audit Log API with your SIEM tool (for example, Splunk) on a regular polling interval for near real-time monitoring of logins, user modifications, and role changes, rather than relying on ad hoc pulls. | Technical | Security Audit Log API |
| Reltio Platform — Networking | Advanced | Network Security | Reltio Private Link | Traffic to the Reltio API travels over the public internet by default. Reltio Private Link is an additional subscription (included with Reltio Business Critical Edition) and isn't enabled unless purchased and configured. | Subscribe to and configure Reltio Private Link for workloads that must keep traffic off the public internet, using your cloud provider's private-connectivity controls (for example, AWS security groups, flow logs, and VPC firewall rules). | Technical | Reltio Private Link |
| Reltio Platform — Networking | Recommended | Network Security | IP allowlisting for connectivity to Reltio | Reltio's cloud infrastructure (AWS, GCP, and Azure) relies on load balancers and auto-scaling groups, so IP addresses behind them change without notice; there is no static allowlist of Reltio IP addresses by default. Static public egress IPs (via NAT gateway) are provisioned only for specific scenarios — for example, a customer system that requires inbound/outbound IP allowlisting, a third-party API with source-IP restrictions, or a regulatory requirement for fixed egress addresses. This row describes allow-listing Reltio's addresses/domains on your side (outbound). For the separate, Reltio-side inbound control — restricting which source IPs may call your tenant's API — see "Tenant IP whitelist (inbound API restriction)" below. | Allow-list the Fully Qualified Domain Names (FQDNs) of Reltio service endpoints rather than IP addresses — this is Reltio Security's recommended and supported method. Request a static public egress IP only for the specific scenarios above, through your account team. | Technical | Connect securely to Reltio services |
| Reltio Platform — Networking | Recommended | Network Security | Tenant IP whitelist (inbound API restriction) | Tenant IP whitelisting is not enabled by default; when disabled, your tenant's API endpoints accept requests from any source IP. The authentication/token endpoint (auth.reltio.com/oauth) is a shared, global endpoint and is never subject to a tenant's IP whitelist, even once whitelisting is enabled — only calls to the tenant's own API endpoints (for example, entity API calls) are checked against it. | Enable tenant IP whitelisting and contact Reltio Support to add your organization's approved source IP addresses. Once enabled, API requests to your tenant from non-whitelisted IPs receive a 403 Forbidden error. | Technical | API Token and Tenant IP Whitelist restrictions (Reltio Support KB) |
| Reltio Platform — Resiliency | Advanced | Resiliency | Reltio Business Critical Edition | Standard Reltio tenants run on multi-AZ resilience without cross-region failover. Business Critical Edition is an additional subscription (requires Concierge Support) and isn't included by default. Once subscribed, core platform components carry a 99.99% availability SLA, a recovery point objective (RPO) under 1 minute for data at rest, and a recovery time objective (RTO) under 1 hour — excluding planned maintenance, force majeure events, and factors outside Reltio's control (for example, third-party outages or customer-controlled configurations). | Subscribe to Business Critical Edition for workloads where cross-region failover and these recovery objectives are a business requirement, and review the SLA's exclusions (data in transit, third-party integrations, custom configurations) against your own continuity requirements. | Non-Technical | Reltio Business Critical Edition |