Retool Self Hosted Security

[jfc]

Current plan level: Business Self Hosted

Question / Description:
I'm trying to utilize Retool Self Hosted to become Hipaa Compliant and have a few questions about it. Seems like there are people using Retool that are both Hipaa and PCI.

What modifications are necessary to make Retool Self-Hosted HIPAA compliant (compared to what already is in the docs)?

How can I control Retool's access to my data and assure auditors that it remains unaccessed?

If Retool manages my authentication (not SSO), how does that communication work?

If Retool manages authentication (not using SSO), how is that communication handled?

[Tess]

Hi @jfc,

Thanks for reaching out!

You might find these related topics helpful:

HIPAA: how did you handle session timeouts, other reqs?

I'm in healthcare industry under HIPAA as well. Our compliance officer gave us greenlight if the Retool is hosted strictly internal, which means no public access at all time, and communicates only limited non PHI data (license check, user invite, etc.) with Retool company (as outlined in Self-hosted Retool quickstart | Retool Docs). Since it's self-hosted internally, we don't have to worry about PHI during external transmittion or how Retool is gonna store / use the data. The Retool entry poin…

Healthcare application development best practices for HIPAA

Hi friends. I am trying to build applications for healthcare to integrate with data from an EPIC electronic health record system. This requires HIPAA compliance. I was wondering if anyone had best practices to share on how to stay in compliance? My default assumption is that even if I have encrypted databases, if it is read by a non-self hosted version of Retool, that I will be out of compliance. Thanks!

For your questions about authentication, do you mean auth with username and password? Curious if you can share more details on your use case & potential concerns

[Anggita_Hayu]

Hello!

1. What changes are needed for HIPAA compliance?
   With Retool Self-Hosted, you control everything. To meet HIPAA needs:

• Host it securely (e.g. AWS or GCP) inside your private network
• Use HTTPS and encrypted storage
• Turn on audit logs and control user access (RBAC)
• Disable any Retool cloud features you don’t use
• Make sure you sign a BAA with Retool if needed

2. How to control access to your data?
   Since it’s self-hosted, Retool can’t access your data unless you let it.
   Just block public access to your databases, use firewalls/VPNs, and turn off data sharing or cloud sync.

3. How does authentication work (if not using SSO)?
   Retool stores passwords securely (hashed with bcrypt) in your setup.
   Login happens over HTTPS, so it’s encrypted.
   You can also add 2FA, session timeouts, and strong password rules.