Every security feature in Maree-DB is a first-class engine primitive — not a plugin, not a wrapper, not an afterthought. From kernel-level integrity monitoring to post-quantum cryptography.
TamperLock anchors every committed transaction to an append-only cryptographic hash chain with inclusion proofs. The chain is signed by the server's Ed25519 key. Any attempt to modify, delete, or reorder historical data causes chain verification to fail — making tampering mathematically detectable without a central authority.
Each block contains the hash of the previous block. The entire audit history is verifiable in a single pass with 256-bit security — faster than SHA-256 with equivalent collision resistance.
Individual transactions can be proven to be part of the chain without revealing other transactions. Ideal for compliance audits where only a specific subject's data needs to be verified.
Forensic audit reports are signed by the server's Ed25519 private key. Recipients can verify the report was generated by the genuine server and has not been modified in transit.
Fortress Lock attaches monitoring probes directly to kernel operations. SQL injection patterns, unusual access rates, and privilege escalation attempts are detected at the kernel level — before any parsing occurs. Autonomous ransomware detection identifies mass-encryption patterns and triggers immediate protective lockdown.
Monitoring programs attach to kernel operations at startup and observe network I/O, file access, and process activity. No additional agent required — fully integrated with verified safety properties.
Rate-based anomaly detection flags unusual query patterns, mass data extraction, mass-encryption activity, and credential stuffing. Configurable sensitivity thresholds per role and per table.
When Fortress Lock triggers, the database enters a cryptographically sealed lockdown: all writes are rejected, a forensic snapshot is captured, and the DBA is notified via syslog and webhook.
All data pages on disk are encrypted with AES-256-GCM. The master key is stored in the OS keyring (libsecret / macOS Keychain / Windows DPAPI) and never written to disk in plaintext. Key rotation is a live operation with zero downtime.
All wire protocol connections (MySQL, PostgreSQL, SQL Server, Redis, REST) are encrypted with TLS 1.3 using rustls — a memory-safe, pure-Rust TLS implementation. TLS 1.0 and 1.1 are permanently disabled. TLS 1.2 is configurable for legacy client compatibility.
All cryptographic key material, plaintext PANs, and PHI values are stored in zeroized memory regions. Memory is securely overwritten before deallocation, preventing cold-boot and memory-dump attacks.
Enterprise and OEM editions support ML-KEM 768 (FIPS 203) for key encapsulation. This protects encrypted data against harvest-now-decrypt-later attacks from future quantum computers.
TamperLock forensic reports and certificate signatures can be signed with ML-DSA (FIPS 204) for quantum-resistant non-repudiation. Compatible with hybrid X25519 + ML-KEM key exchange.
User passwords are hashed with PBKDF2-SHA-256 (310,000 iterations, NIST SP 800-132 compliant). MySQL wire auth uses SHA-1 challenge-response for compatibility; TLS ensures the channel is encrypted first.
Maree-DB implements full Role-Based Access Control (RBAC) with Row-Level Security (RLS) policies and column masking. All access decisions are enforced at the kernel level — RBAC cannot be bypassed by direct file access.
Roles can inherit from other roles. Built-in compliance roles: gdpr_admin, hipaa_admin, pci_admin, payment_processor, auditor, privacy_officer, dpo.
RLS policies filter rows based on the current user's attributes. A SELECT * FROM orders can return only rows owned by the calling user — without application code changes.
PII columns can be dynamically masked for non-privileged roles. email becomes jo*****@example.com and PAN becomes 411111******1111 — automatically, at the query layer.
All compliance operations are expressed as standard SQL function calls. No separate compliance tools, no ETL pipelines, no custom scripts. Run directly from any SQL client.
If you discover a security vulnerability in Maree-DB or our infrastructure, please report it to our security team before public disclosure. We treat every report seriously and respond fast.
security@mareedb.comPlease include: affected version, steps to reproduce, proof-of-concept (if available), and your assessment of impact. PGP encryption for sensitive reports is available on request.
Researchers who have responsibly disclosed vulnerabilities in Maree-DB.