Architecture
Subsalt is commonly deployed into secure, sensitive environments - as a result, the product is intentionally architected to follow modern security best practices. Most importantly, Subsalt never moves sensitive data out of it's designated environment, and never stores sensitive data on disk.
Deployment models
Subsalt is available both as a cloud-hosted offering and a managed instances deployed in customer cloud environments.
Subsalt Cloud runs in Subsalt-managed infrastructure
Subsalt Managed runs in customer cloud environments
Architecture
The product is architected to enable de-identified data interactions at enterprise scale - customers can provide access to a single team or many teams across many organizations using the same components. There are three core components for Subsalt's product that coordinate to support a wide range of deployment configurations and use cases:
Secure Training Environment
Train and evaluate generative models on raw data
Access Point
Run queries to retrieve de-identified results
Hub
Coordination plane for connected training environments and access points
All components run in Kubernetes, and can be deployed in a single cluster or scaled across many clusters. The Secure Training Environment component is the only element of the system that ever has access to raw data, and is therefore typically deployed in a customer's sensitive data environment. Access Points do not have direct connections to Secure Training Environments (or raw data), and sensitive data is not accessed during the process of generating results for a query.
Data minimization
Subsalt's application implements data minimization best practices to further reduce the risk to your datasets. You can be sure that:
Subsalt's system only retrieves sensitive data from data sources that you've configured, and only for the purposes of producing synthetic, de-identified versions of the same data.
Your raw data never leaves the Secure Training Environment(s), and is never persisted to disk. It is purged from the system as soon as the training and evaluation process is completed.
Subsalt does not grant permission to others to access your de-identified data assets.
Last updated