Docs / Security Guide

Security Guide

This guide explains Maree-DB security in plain English - written for someone who isn't a cryptographer but needs to understand how their data is protected.

Section 1: Your Data is Scrambled

Read this first - current status, stated plainly. Encryption at rest and TLS on the wire protocols are in final development. The engines are built and tested, but they are not yet served on a shipped listener. This section describes how those layers work and how they behave once enabled. Until they land: run Maree-DB on a trusted network, and terminate TLS in front of it. We would rather tell you plainly than let you assume.

When encryption at rest is enabled (final development), every page of your database on disk is scrambled. If someone steals your server's hard drives, they get nothing they can read. The data can only be read by Maree-DB running with the correct key.

Think of it like this: even if a thief walks out with your filing cabinet, every document inside is written in a code only you know.

What gets encrypted at rest, once enabled (final development): All database pages (your actual data). All transaction log files. All backups.

Encryption in transit: all four wire protocols are designed for TLS 1.3, and serving it is a tracked launch blocker - it is not enabled on a shipped listener yet (final development). Treat traffic as unencrypted today and protect it at the network layer.

Section 2: Your Keys Explained

Maree-DB uses a five-key system. You hold all of them. Here's what each key does:

Master Key

The main vault door. Keep it on a USB drive in your physical safe. We never see it.

Data Key

Scrambles your actual data. Lives on the server, locked by the Master Key.

Rotation Key

When you change the Data Key, old backups stay readable. No data loss on rotation.

Audit Stamp

Proves nothing in the audit trail was tampered with. Cryptographic proof of integrity.

Emergency Key

Split 5 ways. Any 3 of 5 pieces can recover the vault. No single person holds full access.

The Emergency Key uses a threshold scheme: Split the key into 5 pieces. Give one to the CEO, one to the CTO, one to the CFO, one to your lawyer, one to your most trusted DBA. If you need to recover the vault - disaster, death, incapacitation - any 3 of those 5 people together can do it. No single person can act alone.

Section 3: What SupportCALL Can and Cannot See

What SupportCALL CANNOT see:

  • Your data - Maree-DB runs entirely on YOUR hardware and the binary carries no telemetry, no usage reporting and no phone-home, so none of it is ever sent to us
  • Your queries
  • Your schema
  • Your user list
  • Your audit trail contents
  • Anything about your workload or usage patterns

What SupportCALL CAN see:

  • Your Hardware ID (sent during online licence activation - no more than this)
  • What you tell us when you contact us for support
If a court orders SupportCALL to produce your database, we have nothing to produce. Not as a policy promise, but because of where the software runs: Maree-DB executes entirely on YOUR hardware, the binary carries no telemetry and no phone-home, licence verification is offline, and we operate no key escrow. We cannot hand over what was never sent to us. The only things we may hold are the two items listed above - a Hardware ID from online activation, and whatever you tell us in a support conversation. This rests on the architecture - no data ever reaches us - and not on at-rest encryption, which is still in final development.

Section 4: What Happens If...

Your server is stolen

The thief gets hardware. They get scrambled disk images. Without your Master Key, they have nothing readable. If you report the theft promptly and the server had not been left running and unlocked, your data is safe.

You lose your Master Key

This is why the Emergency Key exists. Gather any 3 of your 5 Emergency Key holders. Together, they can recover the Master Key. This is why you should distribute the Emergency Key pieces before you ever need them.

A hacker gets into your server

Maree-DB's Workload DNA feature will detect anomalous query patterns and alert you. The continuous integrity monitoring will detect any attempts to tamper with the database files. If ransomware is deployed, it's detected in under 10 milliseconds and Fortress Lock activates automatically; PHOENIX then quarantines the touched file for forensics and restores it to a verified-clean state, checksum-verified. Reads stay available throughout, and new writes stay safely paused until the offline verified unlock - your identity check - so an attacker gains nothing even after restore. The Fortress Lock + PHOENIX auto-response ships on the Enterprise tier; the DM Data Vault write fence protects every tier.

SupportCALL closes down

Your licence is verified locally. Once activated, no internet connection is required - ever. Your database continues to run. Your data remains accessible. The software itself contains everything needed to operate. You are not dependent on SupportCALL remaining in business.

You want to move to a different database

Your data belongs to you. Export using standard SQL tools (pg_dump, mysqldump, CSV export). We do not lock your data into a proprietary format. The source is available for inspection. You can always get your data out.