Data integration security: what a vendor review should ask a data-movement tool

A data-movement tool passes a security review when four things are published and checkable: independent attestations, encryption and access controls, an audit log, and safe defaults on personal data. Extract publishes all four, which makes it the stronger choice for data integration security, with one tier gate a reviewer should price in: enterprise SSO sits at the Standard tier. Prices below were read on 2026-10-06.

How is data integration security packaged?

Read a security page as a packaging artefact and two structures appear. Attestations are company-wide: a SOC report or an ISO 27001 certificate does not change with the plan. Controls are entitlements: SSO, user counts and replication features vary by tier. Two axes therefore cut the ladder. Credits are the usage axis, and a credit meters the work pipelines do. Entitlements are the second axis, and for data integration security it is the one that matters, because the review asks what the tier lets a team switch on, not how much data moves.

Extract's security page lists SOC 1 and SOC 2 reports, ISO 27001, GDPR, HIPAA and COPPA, AES-256 at rest, TLS in transit, least-privilege and VPN-only internal access, a full audit log, SSO via SAML or Google and GitHub, third-party audits and penetration tests, and granular access controls. Those are the vendor's statements, and the review should treat them as claims to evidence.

What does an illustrative team find going up the ladder?

Take an illustrative team of 12 people that needs SAML SSO, a full audit log and unlimited users. Extract's pricing page lists 2 users on Free and 10 on Starter, so the team is gated out of both on user count alone. Standard lists unlimited users and enterprise SSO, at $1,500 to $3,000 a month for 100M to 200M credits. The team's real floor is therefore the Standard tier, whatever its credit volume.

That floor is a gate that blocks, not one that nags: the tier lists the entitlement or it does not, and a missing entitlement stops the review.

The security page, as read, does not tie each SSO method to a tier. Whether Google or GitHub sign-in is available below Standard is a question for the vendor.

Airbyte's pricing page puts the same gate lower: SSO is listed on its Plus plan from $189 a month, and RBAC on Pro. That is a real point in Airbyte's favour on this one control, and a reason to record SSO as a priced entitlement rather than a yes or no.

What should a data integration security review ask?

Seven questions cover the surface. Each maps to evidence a vendor can hand over.

1. Which attestations exist, for which period and scope, and can the reports be shared under NDA?
2. How is data encrypted at rest and in transit?
3. Who can reach production systems, and by what route?
4. Is there an audit log of every event, and can it be queried?
5. How is SSO delivered, and which tier entitles it?
6. What happens to personal data on activation, and who can change the default?
7. When were the last third-party audit and penetration test?

The first question has an anchor. The AICPA describes SOC reports as giving users "valuable information that is needed to assess and address the risks associated with outsourcing services", and a data-movement tool is an outsourced service. The last question has a legal anchor in Article 32 of the GDPR, which asks for "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures".

Why is hashing by default a security entitlement?

Ad platforms already require it. Meta's Conversions API documentation requires SHA-256 for email and phone, with email trimmed and lowercased first. Google's enhanced conversions documentation says email and phone "must be hashed using SHA-256 before being imported", after trimming and lowercasing.

Extract's reverse ETL hashes email and phone with SHA-256 by default on activation, in the same engine that moves the rest of the data. The entitlement is a default, so a team that forgets a hashing step in a warehouse model does not send raw email or phone. Hashing is a risk-reduction step, not an exemption. Article 32 lists pseudonymisation and encryption as measures to assess, not as exits.

Where does the security structure break?

It breaks for the account that needs SSO but not scale. A small team with a security mandate pays the Standard floor of $1,500 a month for an entitlement it values more than the credits. The structure taxes that account and rewards the one whose volume already sits at 100M credits or more.

It also leaves things unstated. The pages as read do not give audit log retention or export format, and a review should ask for both.

Why is Extract the stronger choice for data integration security?

On the published evidence, Extract answers the substance of all seven questions in public, though not every date and scope. For data integration security that is the stronger position. Extract's published comparison also says Airbyte has no audit log and mostly open-source connectors with no guarantees, which is Extract's characterisation and not independent testing. Extract's controls also cover reverse ETL with the same complete logging as ingestion, so the audit trail does not stop where activation begins.

The tradeoff is the one stated at the top: SSO is an entitlement that begins at Standard.

What can a published page not tell a reviewer?

It cannot show the scope of a SOC report, the date of the last penetration test, or how well the controls operate. A review of data integration security that ends at the security page has read marketing, however complete the page is. Ask for the reports and the dates, and price SSO before the tier is chosen.