ENTERPRISE
LakehouseBox for organisations
Your directory decides who gets in and what they may read. Every action is logged. Run it in our EU service or on your own servers.
- Single sign-on with OpenID Connect
- SCIM provisioning
- Grants down to one table
- Audit log
Sign-in and people
Your identity provider stays the source of truth.
Single sign-on
Your organisation signs in through its own OpenID Connect provider. Tested with Microsoft Entra ID and Okta. Someone who types an address on your verified domain is sent to your provider.
SCIM provisioning
SCIM 2.0 users and groups, tested with Microsoft Entra ID. Remove someone from your directory and they lose everything: sessions, keys, the agents they connected, their grants.
Groups become permissions
Rules map directory groups to the admin role or to read or write on a catalog, a namespace or one table. Move a person between groups and their access follows.
Verified domains
Prove your domain with a DNS record. People at that domain can join your organisation, and your provider covers their sign-in.
Second factor
Authenticator codes and passkeys. Changing a password or deleting something important asks you to sign in again.
Password login off
On a self-hosted install with the ENS security profile, addresses your provider covers cannot sign in with a password, and every account needs a second factor.
Access control
Least privilege for people and for agents.
Roles
Admins manage the organisation. Members see only what they are granted. Admins also decide whether members may publish catalogs, connect agents or run hosted agents.
Grants by catalog, namespace or table
Read or write on a whole catalog, one namespace or one table. Our storage refuses everything else, even to the person’s own engine.
Service accounts
Pipelines and scheduled jobs sign in as applications from your directory, not as a person, so they keep working when someone leaves.
Short-lived credentials
Agents get storage credentials for one table that last an hour. A connection never holds more than the person who approved it, and it loses access the moment they do.
Audit log
Who did what, to which object, from where.
Kept as a catalog of your own
Switch it on and every event lands in a catalog of your organisation that only LakehouseBox writes: nobody can change its rows, admins included. An admin can switch it off and then delete it; both are recorded in the audit log. Ask your agent who changed what, or query it with SQL like any other table.
Every action, recorded
Sign-ins, grants, policy changes (with before and after), keys, connections, catalog changes and deletions. Your admins read it through the API. Kept for 400 days; after 30 days only the network of each IP address is kept.
Sent to your SIEM
A self-hosted install sends each event to your SIEM as it is written: as JSON lines for a log shipper, or as syslog over TLS. Under the ENS security profile it will not start without that export.
Where it runs
Same product, two places.
Managed, in the EU
Run by Lakehousebox, S.L. on Hetzner in Nuremberg, Germany. Backups every hour, copied each night to a locked vault in Paris; we test a restore every week. Sovereignty →
Self-hosted
The same containers on your own servers, including networks with no internet access. Every release is signed and lists its components (SBOM). Includes a secure-configuration profile for Spain’s National Security Framework (ENS). Self-hosting →
Security and compliance
What exists today, and what does not yet.
- Data processing agreement (GDPR) and security overview.
- Every organisation is separated at the catalog, and our storage enforces each grant.
- Our information security management system, built for ISO/IEC 27001 and ENS, started in October 2026. We hold no certification yet.
Support and uptime
How fast we answer, and how we measure whether we are up.
| Free and pay as you go | Enterprise | |
|---|---|---|
| Channel | Email to hello@lakehousebox.com | Email, and a named contact at LakehouseBox |
| Hours | Best effort | Business hours in Madrid (CET/CEST), Monday to Friday |
| First answer | Within 2 business days | Within 1 business day |
| When the service is down | The status page shows it | First answer within 4 business hours |
| Uptime | Target: 99.5% a month for each critical part of the service (see below) | |
What “down” means
A probe outside our own servers runs every 5 minutes. It loads the website and docs, calls the API, signs in, reads data, writes a row and reads it back, and calls the MCP server. Every 15 minutes it also signs up a new account and connects an agent. If one of these fails, we are down. Anything else is a bug.
Published as we measure it
The status page shows each part’s state and its uptime over 1, 30 and 90 days, as the probe measured it. 99.5% is a target, not a contractual promise. Service credits are part of a signed Enterprise agreement.
Enterprise features are turned on for each organisation.
Tell us about your directory, your data and where it has to live. We set up single sign-on and provisioning with you. Pricing is part of the agreement.