Skip to content

Security

You are trusting us with a connection to your data. Here is exactly what that connection looks like — how credentials are stored, how the network path works, and what AZ-Five can and cannot do.

Your credentials, encrypted and unreadable

Every database credential you give AZ-Five — passwords, CA certificates, SSH keys — is encrypted before it is stored, with keys derived per secret class so one compromised ciphertext class never exposes another. Secrets are never returned by any API, are stripped from every response, and driver errors are scrubbed before they reach a log line.

Read-only by construction

Every query AZ-Five sends to your database passes through a central SELECT-only enforcement layer, parsed per SQL dialect. There is no code path that can write to a connected database. We also recommend — and document — creating a dedicated read-only database user, so the guarantee is enforced on both sides.

Private databases stay private

Databases in a private subnet never need a public endpoint. AZ-Five connects through an SSH tunnel to your bastion host:

  • AZ-Five generates the SSH keypair server-side. The private key is encrypted at rest and never leaves our infrastructure — you install only the public key on your bastion.
  • The bastion’s host key is pinned on the first verified connection and checked on every sync. If it ever changes, syncs hard-fail until you re-verify.
  • Your database’s private address is resolved by the bastion, inside your network. AZ-Five never dials it directly.

Defense against reaching the wrong host

Connector hosts are validated against an egress guard before any connection is made: cloud metadata endpoints — the credential-theft target of SSRF attacks — are blocked outright, and DNS answers are checked so a hostname cannot smuggle a connection to one. Private addresses stay usable, because self-hosted and in-VPC databases are legitimate; the product recommends the SSH tunnel for them instead of forcing it.

TLS everywhere, verified when you want it

Direct connections support required TLS and full certificate verification — paste your CA bundle (for AWS RDS, the region bundle) and AZ-Five verifies the server’s identity on every connection. Static egress IPs let you allowlist exactly which addresses may reach your database.

Multi-tenant isolation

Every tenant’s metadata rows are isolated with PostgreSQL row-level security enforced at the database role level, and connector credentials are scoped to your organization. Enterprise deployments can run fully siloed — a dedicated instance inside your own VPC.