Docs / Security Guide
This guide explains Maree-DB security in plain English - written for someone who isn't a cryptographer but needs to understand how their data is protected.
When encryption at rest is enabled, every page of your database on disk is scrambled. If someone steals your server's hard drives, they get nothing they can read. The data can only be read by Maree-DB running with the correct key.
Think of it like this: even if a thief walks out with your filing cabinet, every document inside is written in a code only you know.
What's encrypted: All database pages (your actual data). All transaction log files. All backups.
What's not encrypted in transit: Nothing - all four wire protocols use TLS 1.3. Network traffic is always encrypted.
Maree-DB uses a five-key system. You hold all of them. Here's what each key does:
The main vault door. Keep it on a USB drive in your physical safe. We never see it.
Scrambles your actual data. Lives on the server, locked by the Master Key.
When you change the Data Key, old backups stay readable. No data loss on rotation.
Proves nothing in the audit trail was tampered with. Cryptographic proof of integrity.
Split 5 ways. Any 3 of 5 pieces can recover the vault. No single person holds full access.
What SupportCALL CANNOT see:
What SupportCALL CAN see:
The thief gets hardware. They get scrambled disk images. Without your Master Key, they have nothing readable. If you report the theft promptly and the server had not been left running and unlocked, your data is safe.
This is why the Emergency Key exists. Gather any 3 of your 5 Emergency Key holders. Together, they can recover the Master Key. This is why you should distribute the Emergency Key pieces before you ever need them.
Maree-DB's Workload DNA feature will detect anomalous query patterns and alert you. The continuous integrity monitoring will detect any attempts to tamper with the database files. If ransomware is deployed, it's detected in under 10 milliseconds and Fortress Lock activates automatically; PHOENIX then quarantines the touched file for forensics and restores it to a verified-clean state, checksum-verified. Reads stay available throughout, and new writes stay safely paused until the offline verified unlock - your identity check - so an attacker gains nothing even after restore. The Fortress Lock + PHOENIX auto-response ships on the Enterprise tier; the DM Data Vault write fence protects every tier.
Your licence is verified locally. Once activated, no internet connection is required - ever. Your database continues to run. Your data remains accessible. The software itself contains everything needed to operate. You are not dependent on SupportCALL remaining in business.
Your data belongs to you. Export using standard SQL tools (pg_dump, mysqldump, CSV export). We do not lock your data into a proprietary format. The source is available for inspection. You can always get your data out.