← Halo Knox / Deployment guide

Crisp Halo | Deployment guide

Databricks: customer-operated deployment of Crisp Halo, where data is only available to the customer

Document ID

HALO-DEP-DBX-011

Version

1.1 (Draft)

Product

Crisp Halo

Last updated

22 October 2026

Audience

Customer IT and security teams

Classification

External

Cloud

Databricks

Governance

Databricks Unity Catalog

Crisp Halo is installed and runs entirely inside the customer’s own Databricks environment. Access control, lineage and auditing are handled by Databricks Unity Catalog. Only the customer has access to the data, and neither Crisp nor its contractors can reach the software or the data. The only information that goes to Crisp is bug reports. This is the same model used in regulated industries such as banking, telecom and pharma. In Halo Knox terms, this is Sealed.

1 Background

Companies routinely use third-party technology in their own environments to store, analyze and report on data, from cloud platforms such as Databricks, Snowflake and Google Cloud to tools such as Tableau, Power BI and Excel. A customer-operated Halo deployment follows the same pattern.

2 Deployment models

Hosted

Crisp operates Halo like a SaaS tool. Data flows to Crisp, and users work in Crisp’s interfaces.

Customer-operated

Halo is installed in the customer’s own cloud infrastructure. The customer runs it and controls access to its data. This guide describes this model.

3 How it works

The customer’s IT team installs Halo in its own Databricks environment, where it runs against the customer’s data pipelines. The customer holds the credentials, network controls and encryption keys. Crisp does not host, receive, store or query the data, and has no credentials to the customer’s environment.

Customer’s Databricks environment · customer holds credentials, network controls, keys

Customer data
pipelines

→

Crisp Halo
(customer-operated)

↔

Unity Catalog
access · lineage · audit

Users sign in through the customer’s identity provider (SSO + MFA)

sanitized bug report
approved and sent by the customer’s IT administrator only

Crisp
no accounts · no VPN · no data

Crisp’s commitments

No access

Crisp personnel have no accounts, VPN connections or support tunnels into the customer’s environment.

Sanitized bug reports only

A report describes a fault in terms of code, configuration, schema and error behavior, with no data. It goes to the customer’s IT administrator, and only the administrator can send it to Crisp.

Synthetic data

Crisp reproduces issues, tests and trains on synthetic data.

Updates on the customer’s schedule

Crisp ships fixes as software releases. The customer chooses when to install them.

Audit evidence

Crisp completes vendor risk assessments, provides security documentation, its SOC 2 Type II report and its ISO 27001 certificate, and supports review by the data owner’s security team.

The data stays inside infrastructure the customer already controls and has secured. The customer keeps the data, the access and the keys.

4 Governance and access run on Databricks Unity Catalog

Identity, login and data governance run on Databricks and Unity Catalog, managed by the customer’s IT team. Crisp has no accounts in the environment, so none of these controls depend on the vendor.

Control	How it works	Owned by	Mechanism
Single sign-on + MFA	Users sign in through the customer’s identity provider, which enforces multi-factor authentication.	Customer IdP	`account-level SSO`
Provisioning	SCIM syncs users and groups from the identity provider to the Databricks account, so identities are consistent across workspaces.	Customer IT	`SCIM`
Service principals	Automated workloads authenticate as service principals, not as individual users and not with shared passwords.	Customer IT	`service principal`
Access control	Unity Catalog grants privileges to users, groups and service principals on catalogs, schemas, tables and other securable objects, down to rows and columns.	Customer IT	`GRANT / REVOKE`
Attribute-based access	ABAC policies use governed tags to apply the same rules across a whole catalog or schema.	Customer IT	`governed tags`
Row filters + column masks	Each user sees only the rows they are permitted to see. Sensitive columns are masked.	Customer IT	`ROW FILTER / MASK`
Network controls	IP access lists limit connections to trusted IP ranges. Private connectivity is available.	Customer IT	`IP access lists`
Lineage + auditing	Unity Catalog records column-level lineage. Audit logs are available as system tables.	Customer IT	`system.access.*`
Encryption keys	The customer can encrypt data with its own keys.	Customer IT	`customer-managed keys`

-- illustrative: row-level and column-level control, set by the customer’s IT team
ALTER TABLE sales.orders SET ROW FILTER region_filter ON (region);
ALTER TABLE sales.orders ALTER COLUMN unit_cost SET MASK mask_cost;

-- audit and lineage, queryable by the customer
SELECT * FROM system.access.audit;
SELECT * FROM system.access.column_lineage;

More information about Databricks Unity Catalog: docs.databricks.com/aws/en/data-governance