Security & Compliance

Partnership & Security Protocol: Zero-Trust DataOps

At Tech-Macro, we operate on a strict technological partnership model. We do not act as an external agency extracting your data; we integrate our engineering logic directly into your secure environment.

To ensure absolute compliance with GDPR and European data security standards, all R&D, FinOps audits, and DataOps implementations are governed by the Zero-Trust Architecture.

1. Zero-Trust & Infrastructure Perimeter

Our core operational rule is simple: We bring the code to the data, not the data to the code.

  • No Data Extraction: We never export, download, or copy your raw data, PII (Personally Identifiable Information), or business metrics to external servers.
  • Client-Side Execution: All data processing, transformation, and orchestration happen exclusively within your Google Cloud Platform (GCP) organization.
  • Auditability: Every action taken by our engineers is logged via Google Cloud Cloud Audit Logs, giving your security team 100% visibility into our operations.

2. Identity and Access Management (IAM)

Access is granted based on the Principle of Least Privilege (PoLP). We do not require full Project Owner or Editor roles.

  • Granular Roles: We operate using custom IAM roles or strict pre-defined roles (e.g., BigQuery Data Viewer, BigQuery Job User, Storage Object Viewer) strictly limited to the development and staging environments.
  • Production Separation: Direct write access to production data is restricted. All production deployments are executed via automated CI/CD pipelines, not through manual engineering access.
  • Service Accounts: We utilize dedicated GCP Service Accounts for automated processes (like the Analytics Firewall), ensuring human engineers are decoupled from automated production workflows.

3. GDPR & PII Compliance Framework

As a partner, we design pipelines that natively protect your users’ privacy.

  • Data Masking: During the Analytics Firewall implementation, we deploy automated hashing and masking for any columns containing potential PII before the data reaches the analytical layer.
  • European Data Residency: Because we operate within your GCP perimeter, your data never leaves its designated region (e.g., europe-west3 in Frankfurt), maintaining strict compliance with local data sovereignty laws.

4. Code Deployment & CI/CD Protocol

We treat infrastructure and data pipelines as code. Your internal team retains total control over what gets deployed.

  • Version Control: All code (SQL, Python, Terraform, dbt models) is written and stored in your internal Git repositories (GitHub/GitLab/Bitbucket).
  • Pull Request (PR) Reviews: No code goes into production without a PR. Your lead engineers or CTO have the final approval step.
  • Infrastructure as Code (IaC): When setting up environments, we use Terraform. This ensures the architecture is reproducible, documented, and fully owned by you.

5. Ownership & Handover

A true partnership implies the absence of vendor lock-in.

  • 100% Intellectual Property Transfer: All algorithms, data models, and scripts developed during the partnership belong to your company.
  • Documentation: Every dbt model and Airflow DAG is delivered with self-updating, complete documentation.
  • Asynchronous Exit: If the partnership concludes, your internal team simply revokes our IAM access. The infrastructure, code, and automated pipelines continue to run autonomously without any disruption.