Security architecture
Built so a mistake is contained, and every action is accounted for
Managed databases hold the data a business cannot lose. These are the controls that protect them, and an honest note on the ones still being built.
Controls
Each is marked with whether it is enforced today or still on the roadmap.
Separated control and data planes
AvailableThe dashboard and orchestration layer are isolated from the instances running your data.
No shell access to database hosts
AvailableCustomers never get root or shell on a managed database host. Engine-level work goes through the control plane.
TLS on public connections
AvailableManaged endpoints serve TLS, and connection strings default to requiring it.
Per-database IP allow-lists
AvailableTraffic to your endpoint is dropped at the host firewall unless it comes from an address you listed.
Encrypted secret storage
AvailableDatabase credentials are encrypted at rest with AES-256-GCM. Login passwords are hashed; API keys are stored hashed and shown once.
Role-based access control
AvailableOwner, Admin, Developer and Viewer roles govern what each team member can do.
Immutable audit trail
AvailableEvery credential reveal, firewall change, deletion and lifecycle action is recorded with actor, source address and time.
Private networking
On the roadmapPrivate endpoints for customers on Webyne private networking.
MFA for privileged administration
On the roadmapMulti-factor authentication on privileged Webyne operator accounts.
Encrypted, off-host backup repositories
On the roadmapBackup copies held separately from primary compute, with cross-data-centre options.
How network isolation actually works
Each database is published on its own port, and every port has its own firewall chain on the host. When you add an address to a database's allow-list, traffic from anywhere else is dropped before it reaches the engine — the database never sees the packet.
Rules match on the port the client originally dialled, which matters more than it sounds: a naive firewall rule on a container-published port silently does nothing, because address translation has already rewritten the destination by the time the rule is evaluated.
Established connections keep flowing while you change the rules, so tightening an allow-list does not drop your running application.
Default posture
- A new database with no allow-list is reachable from any address. The dashboard and the AI DBA both flag this as a critical finding rather than leaving it silent.
- Add your application servers and everything else is dropped at the host firewall.
- Turn off public access entirely for databases that should only be reachable privately.
Operational practice
Vulnerability management and patching
Engine versions are explicit and upgrades are tested before being offered to customers.
Restore drills
Backups are restore-tested automatically. A backup that has not been restored successfully is not treated as valid.
Least privilege for applications
Create scoped database users with read-only or read-write access rather than connecting applications as the generated admin account.
Credential handling
Database passwords are encrypted at rest and shown only on request. API keys are stored hashed and displayed once, at creation.
Audit trail
Security-sensitive operations are recorded with the actor, their source address, the target and the time — including the ones people forget to log.
| Recorded action | Why it matters |
|---|---|
| Credentials viewed | Reveals who has seen a database password, and when. |
| Firewall changed | Shows exactly when an endpoint was opened or closed. |
| Database deleted | Records the request before teardown begins, so it survives a failed delete. |
| Backup created or restored | Establishes the recovery timeline after an incident. |
| Password changed | Signals account takeover attempts; failed attempts are logged too. |
| Role changed or user removed | Tracks who can act on your infrastructure over time. |
| API key created or revoked | Machine access is as sensitive as human access. |
Reviewing us for a security-sensitive workload?
We will walk your team through the architecture and answer the awkward questions directly.