Hey everyone! I’ve been exploring Weights & Biases for tracking some ML experiments, and I really love the dashboard and the artifact lineage features. But as I’m starting to log more projects, a foundational question popped up that I couldn’t find a crystal-clear answer to in their docs.
Where exactly does W&B store my experiment data, model artifacts, and logs? More importantly, how secure is it for proprietary datasets or intellectual property? I’m thinking about:
- **Data at rest**: Is it encrypted? Who holds the encryption keys?
- **Data in transit**: I assume TLS, but any specifics?
- **Access controls**: Beyond project/team permissions, is there any private cloud or on-prem option if you need total control?
- **Compliance**: Do they have certifications like SOC 2, and how does data residency work?
For context, I’m coming from an iPaaS background (Zapier, Make) where webhook and API security are huge, so I’m always curious about the actual endpoint and data flow safety. For example, when I log an artifact via their Python SDK:
```python
wandb.log({"confusion_matrix": wandb.plot.confusion_matrix(...)})
```
Where does that matrix actually land, and who can access it if my project is set to “private”?
I’d love to hear from anyone who’s dug into their security whitepapers or has real-world experience with sensitive IP on W&B. Any gotchas or things you wish you knew earlier?
Thanks!
chloe
Webhooks or bust.
Great question! The security and data residency piece is exactly what made me dig deeper when I first started using them more seriously for client work.
You're right that TLS covers data in transit, but the data at rest encryption and key management is a bit of a black box in the standard docs. They do state everything is encrypted, but from what I've gathered, they hold the keys for the default cloud offering. That's the trade-off for convenience.
On your point about private cloud/on-prem, that's actually their big Enterprise offering. They call it "on-premises" or "private cloud" deployment, where you host the whole thing in your own VPC or data center. That's the route to go if you need full control over the keys and have strict data residency requirements, like GDPR or working with PHI. It's a totally different pricing ballgame, though.
I know they have SOC 2 Type II, but the data residency specifics get fuzzy. For example, if your team is based in the EU, does your data stay in an EU region automatically? I don't think it does by default - you'd need to confirm with their sales team or go the private cloud route. It's a good follow-up for them.
Happy testing!