Our shared security partnership

Looker can connect to your organization’s database and is designed to leave your data in that database, or as otherwise instructed by you. Because Looker connects to technology that you are responsible for maintaining, security is a shared responsibility between Looker and you. We publish our security posture and best practices publicly here. If you use embedded analytics functionality, Looker has developed security best practices you can leverage to help mitigate security concerns.

Application data shared by Looker

While there is no permanent storage of your data in the Looker application, Looker utilizes a number of first- and third-party tools in order to provide and improve the service. Unless stated, all services share data with locations in the United States.

Application services include:

Licensing data	A Looker service that gathers information about how the service is being used to ensure that usage is in compliance with the customer’s licensing terms. This information includes metadata about users, roles, database connections, server settings, features used, API usage, and version.
Product usage	A Looker service and Google Analytics 360 gather pseudonymized usage data about how users are using the Looker product and how well it is performing. This data is analyzed and used to improve the Looker product. Administrators can disable these services for their instance by contacting Support.
Configuration backups	A Looker service that encrypts backups for Looker system’s configuration, which includes saved Looks, query history, encrypted user and database credentials, and Looker user settings. Configuration backups are now stored in Google Cloud and retained for 180 days. All configuration backups prior to January 2022 are stored in multiple cloud providers including AWS, Google Cloud, and/or Microsoft Azure and will expire by June 2022.
System error reports	Looker service that transmits runtime exceptions to Looker internal systems in order for Looker technicians to diagnose issues with the product. These messages are first sent as HTTPS requests, but will fail-over to email via a customer’s Looker’s SMTP settings if necessary.
Support access	Optional Looker service that allows Looker technicians to troubleshoot problems by permitting authentication into a customer’s Looker application. This access is limited to Support use cases and can be enabled by customers.
Data actions	Optional Looker service that forwards data, upon your instruction, to a variety of third-party services of your choosing. Any data your users send using an action will be processed temporarily on Looker’s managed Action Hub rather than in your Looker instance. https://docs.looker.com/admin-options/platform/actions
Email notifications	Optional third-party service (Twilio SendGrid) that transmits emails from noreply@looker.com and noreply@lookermail.com in order to provide new account welcome emails, forgotten password reset links, and scheduled data delivery for Looker users. If you prefer, you can alter this configuration to use your own SMTP integration instead.
LookML storage	Develop and store your LookML code in Looker’s first party git repository. Customers that implemented Looker’s legacy third-party service (GitHub) will be migrated to their own git repository or Looker’s first party git repository by the 23.0 release. Customers can use their own git repo by updating this configuration.
In-app guides and in-product messaging	Optional third-party service (Pendo) that delivers personalized messages to users to help them more easily use the Looker product. This service collects basic pseudonymized usage data in order to personalize messages and guides and submit feedback. Administrators can disable this service for their instance.
Support chat and tickets	Optional third-party service (Zendesk) that provides an embedded chat client in order to facilitate product support.

NOTE: We regularly review both our internal services and third-party service providers to ensure that the data we collect is aligned with the service’s intent, and that the security measures employed meet our high security standards.

Google responsibilities

Cloud security	Google uses established public cloud hosting providers that the customer selects, to augment Looker’s security program with additional security and availability operational controls.
Product security	Google is responsible for ensuring that the code quality for the Looker application is developed according to industry-wide best practices for secure software development and is regularly tested for vulnerabilities.
Corporate and Physical security	Google is responsible for educating and disseminating security best practices.

Your responsibilities

Cloud security

You are responsible for configuring secure access between the Looker application and your database. Google provides multiple recommendations on how to configuring this access, including:

Enabling secure database access using tools like IP allowlisting, SSL/TLS encryption, and SSH tunneling
Setting up the most locked-down database account permissions for Looker that still allow it to perform needed functions

Product security

You are also responsible for controlling access and permissions for users of your Looker instance. Google recommends:

Setting up user authentication using either a native username/password option or, preferably, using a more robust authentication mechanism like 2FA, LDAP, Google OAuth, or SAML
Setting up the most restrictive user permissions and content access that still allow people to carry out their work, paying special attention to who has admin privileges
Setting up any API usage in a secure way
Regularly auditing any public access links your users create and restricting the permission to create them, as necessary

Cloud security architecture

Google hosts the Looker application on proven public clouds, which means that as a Looker customer you can inherit the robust standards of cloud security maintained by these cloud providers (currently AWS, Azure, and Google Cloud) in addition to the security best practices within the Looker product. Google uses industry best practices for the development and testing of the Looker application, ensuring that code quality meets appropriate standards before becoming part of a Looker release. For more information about how Looker works with your data, see Looker’s Privacy Notice.

Cloud infrastructure
Public cloud facilities	The Looker application is managed in public cloud datacenters. These facilities implement various physical and environmental controls to ensure that Looker customer data is well protected from possible theft or loss.
Logical separation of data	While Looker does not persist customer database information, unless instructed by the Customer, the application does store configuration information, event data, and cached query results. Looker is architected to logically separate this information in order to isolate customer data and reduce cross-tenant exposure risk.
Data security architecture	Looker follows best practices for security architecture. Proxy servers secure access to the Looker application by providing a single point to filter attacks through IP denylisting and connection rate limiting.
Redundancy	Looker employs a Cloud-based distributed backup framework for Looker-hosted customer servers.
Availability and durability	The Looker application can be hosted in a variety of different public cloud data centers across the globe.
Monitoring & authentication
Access to a customer’s back-end servers	Access to a Looker-hosted back-end environment requires approval and multiple layers of authentication.
Access to a customer’s Looker application	Google employee access to customer Looker instances is provided in order to support a customer's needs. Access requires approval and multiple layers of authentication. Additionally, customers can control all access from Looker to their application via a Support toggle.
Monitored user access	Access to your Looker environment is uniquely identified, logged, and monitored.
Network and application vulnerability scanning	Looker’s front-end application and back-end infrastructure are scanned for known security vulnerabilities at least monthly.
Centralized logging	Logs across the Looker production and corporate environments are collected and stored centrally for monitoring and alerting on possible security events.
Reputation monitoring/ threat intelligence	Collected logs and network activity are checked against commercial threat intelligence feeds for potential risks.
Anomaly detection	Anomalous activity, like unexpected authentication activity, triggers alarms.
Data security encryption
AES encryption	Locally-stored sensitive application data, including database connection configurations and cached query data, is encrypted and secured using AES encryption.
Secure credential storage & encryption	Native usernames and passwords are secured using a dedicated password-based key derivation function (bcrypt) with hashing and salting.
TLS encryption	Data in transit is encrypted and secured from the user's browser to the application via TLS 1.2.
SSL / SSH encryption	Looker enables you to configure your database connection via encrypted TLS 1.2 or SSH.

Product security

Overview
Code development	Code development is done through a documented SDLC process that includes guidance on how code is tested, reviewed, and promoted to production.
Peer review and unit testing of code	Code is peer reviewed before being committed to a release version. Functional and unit tests are performed using automated tools.
Routine developer training	Developers are regularly trained on secure coding practices.
Code quality tests	Looker utilizes automated tests specifically targeting injection flaws, input validation, and proper CSRF token usage.
Regular third-party penetration testing	Looker performs regular third-party penetration tests against the Looker application and hosted environment.
Single sign-on	Looker provides SAML-based single sign-on for users, offering support for SSO solutions from Google Apps, OneLogin, and SAML.
LDAP authentication	Looker provides the ability to authenticate users based on Lightweight Directory Access Protocol (LDAP), enabling administrators to link LDAP groups to Looker roles and permissions.
Two-factor authentication	Looker provides the ability to use two-factor authentication via Google Authenticator.
Responsible disclosure	Looker embraces the security community and operates a responsible disclosure program to facilitate security vulnerability reporting.
Security due diligence of third-party service providers	All third-party service providers go through an annual security review. For in-app guides, Looker serves the third-party software (Pendo) Javascript. The individual guides are vetted and allowlisted by Looker. When fetching a guide from Pendo, Looker validates that the guide is unchanged using SHA-256 integrity hashes. If there are any changes to the guide after Looker’s review, Looker prevents use of the changed guide.

Corporate security

Google has robust security protocols that are meant to secure Looker office spaces and materials that contain sensitive information. Learn about Google security at: https://cloud.google.com/security

Data security, privacy, & compliance

One of the priorities of Google Cloud security practices is to ensure that use of your data is transparent, safe, and respectful. To that end, Looker maintains a Compliance team to perform regular assessments and ensure that risks are appropriately being mitigated and that controls are designed and operating correctly.

Data security & compliance
SOC 2 type II	Looker’s SOC 2 Type II report covers the trust services categories of Security, Confidentiality, and Availability and is audited annually. The report is available, upon request, for review by existing customers and new prospects. As the information is confidential, we require a signed NDA to review the report. Note: While our current SOC 2 Type II report only covers our customers housed in the AWS and Google Cloud environment, we are actively working on our SOC 2 Type report for our Azure environment.
HIPAA security	Looker customers include HIPAA Covered Entities and Business Associates. Since Looker doesn’t extract your data, we don’t categorize data as sensitive, personal health information, or according to other schemas. Instead, we handle all data according to the same security standards. To support HIPAA compliance, Looker engages with a third-party to perform HIPAA Security Rule audits annually. To assist you with your HIPAA-related security obligations, Looker maintains a Business Associate Agreement (BAA) available to execute as needed.
Cloud Security Alliance (CSA) STAR assessment	Looker has completed the CSA's Consensus Assessments Initiative Questionnaire (CAIQ), which provides a set of questions a cloud consumer may wish to ask of Looker to ascertain their compliance with the Cloud Controls Matrix and CSA best practices. It is available for download here and will be updated periodically.
ISO 27001 certification	Looker has completed the ISO 27001 Compliance certification and it can be viewed on our compliance portal, under NDA. By being audited to the ISO 27001 standard, we demonstrate our commitment to identifying risks and putting in place strong, repeatable controls ensuring that our organization maintains a secure posture.
Other security compliance initiatives	Looker also provides options to help you with other compliance efforts. Ask your sales representative for more information.
Data privacy
Determine where Looker is hosted	Looker provides a number of locations where your Looker application and configuration backups can be hosted. This includes the US, Japan, Ireland, Germany, Australia, or Brazil.