Built so we never need your data.
The safest place for your records is the one you already control. ColdCTL is designed around that, from where it runs to how it deletes.
Eight promises, in plain words.
Your data stays in your accounts
The agent and the Archive Gateway run on your servers. Archives are written to a bucket you own, using credentials you control, such as AWS roles or Azure managed identity.
Our cloud sees a summary only
ColdCTL Cloud is optional. It receives an allowlisted summary of each job: names, counts, sizes and status. Rows, passwords, connection strings and file paths stay with you.
No remote control
ColdCTL Cloud cannot start, stop or change anything on your agent. Every action is run by your team, on your side.
Nothing is deleted without proof
Deletion is off by default. When enabled, each row is compared with the verified archive inside the same transaction. Any difference rolls the batch back.
Signed archives
The agent can sign each archive’s manifest. The Gateway refuses archives with a missing or wrong signature, so a file cannot pretend to belong to another team.
Company sign-in and fine-grained access
The Gateway uses OpenID Connect single sign-on. Access is granted per dataset and per column, on every path: search, record views, exports and downloads.
New columns stay hidden
When a table gains a column, it is not shown to anyone until an administrator grants it. Schema changes cannot leak sensitive fields.
Signed, checksummed releases
Releases come with checksums and build attestations. Database connectors are signed and installed separately, so you only run what you need.
Let your database keep only what it needs.
We are working closely with a small group of PostgreSQL teams. Tell us about your largest tables and we will help you run the first archive.