> AI agents: this is one page from Mammoth Analytics documentation. The index of all pages as Markdown is https://docs.mammoth.io/llms.txt. Append `.md` to any docs URL, or send `Accept: text/markdown`, to get Markdown.

# Data security

> How Mammoth encrypts connector credentials, protects browser sessions, where customer data is stored, and which network ports data sources must allow.

This page is for IT administrators and security reviewers. It covers how Mammoth protects credentials and sessions, where your data is stored, and the network ports data sources must allow.

## Credentials

Credentials you give Mammoth for connectors, such as database passwords and API secrets, are encrypted with RSA public-key encryption (PKCS1-OAEP). The private key is stored separately from the encrypted values.

## Sessions

Browser sessions use HTTP-only, Secure cookies, so the session cookie is only sent over HTTPS and is not readable by JavaScript. See [Sign-in and authentication](https://docs.mammoth.io/learn/security-overview/authentication/) for session lifetime and CSRF protection.

## Data location

By default, customer data is stored in AWS Ireland (EU).

## Network requirements

For Mammoth to connect to your data sources, the source must be reachable from Mammoth on its standard port:

| Traffic | Port |
| --- | --- |
| Mammoth services (HTTPS) | 443 |
| PostgreSQL | 5432 |
| MySQL | 3306 |
| SQL Server | 1433 |

If your database listens on a non-default port, allow that port instead. IP allowlisting and VPC deployment are available on the Enterprise plan.

---
Source: https://docs.mammoth.io/learn/security-overview/data-security.md · Updated: 2026-10-13