Security Architecture
ArmorDB is designed with a "Secure by Default" philosophy. We employ multiple layers of defense to protect your data, from hardware-level isolation to application-layer encryption.
Encryption at Rest
All database volumes and backups are encrypted using AES-256-GCM. Encryption keys are managed through a dedicated Hardware Security Module (HSM) and rotated regularly.
Network Isolation
Each database instance runs in a strictly isolated container environment with enforced CPU and memory limits. The public database gateway requires TLS and database credentials. The pooled and direct public endpoints both require TLS. Direct public admin-role connections are rejected.
Mutual TLS (mTLS)
ArmorDB uses mutual TLS between the backend and the provisioning agent. Public PostgreSQL clients use standard server-authenticated TLS and database passwords, without client certificates. The pooler-to-PostgreSQL connection uses TLS with certificate and hostname verification on the private Docker network.
- Prevents man-in-the-middle attacks by verifying server identity.
- Authenticates the backend and provisioning agent with client and server certificates.
- Ensures data integrity during transmission.
SOC 2 & Compliance
ArmorDB is built on SOC 2 Type II compliant infrastructure. While we are a young company, we adhere to the strictest security standards for data handling and access control. Detailed security reports are available for Enterprise customers upon request.