Stop unauthorized database
access before data leaves.
Identity-aware access control, policy enforcement, dynamic masking and complete audit — an inline security proxy that sits between your applications and your databases. No changes to your clients. No changes to your database.
One policy layer for every access to your data — by people, applications, and AI agents.
Your database is the last place you can’t see
Applications talk to the database directly, over a shared login, on a protocol your security tools don’t read. When something goes wrong, you find out from the logs — after the data has already left.
One login, many users
Apps connect with a single service account, so you can’t tell one user’s access from another — or stop just one of them.
Logging is after the fact
Audit logs tell you what happened once it already has. They record the breach; they don’t prevent it.
Sensitive data walks out
Query results return raw PAN, PII and secrets in full. Nothing sits in the path to mask or block them.
Inspect, don’t implement
DSGuard sits inline between your applications and your databases. It reads the wire protocol to understand each request, applies your policy, then forwards the traffic unchanged — no protocol emulation, no client or database changes.
Applications
Your existing clients & services, unchanged
DSGuard Gateway
Inspect · authenticate · enforce · mask · audit
Databases
PostgreSQL, Oracle, SQL Server, MySQL, MongoDB, ClickHouse
A query arrives
The client connects to DSGuard instead of the database. DSGuard authenticates the user (MFA) before any query runs.
It’s inspected
The SQL is extracted from the wire protocol and checked against injection patterns, dangerous-function rules, object permissions and time/app/IP policy.
Allowed, masked or blocked
Permitted traffic passes through; sensitive columns are masked in the response; disallowed requests are denied by default — every outcome is decided inline.
Everything is logged
Query, identity, decision and reason land in the audit store and dashboards — a complete, attributable record of who did what.
Inside the gateway
- Authentication — MFA/TOTP, Ident/Peer
- Policy engine — object permissions, time, application and IP rules, connection limits
- Threat prevention — SQL-injection patterns, dangerous functions, rate limiting
- Masking — column-level, full/partial/hash, format-preserving and Lua-scripted
- Audit — query, identity, decision and block reason, with GeoIP context
Fits your existing stack
- Identity — TOTP MFA
- Observability — Prometheus metrics endpoint, provisioned Grafana dashboards
- Log pipeline — centralized query and application logs for your SIEM
- Transport — TLS-encrypted client connections on every engine, TLS to supported backends, Oracle Native Network Encryption
- Deployment — on-prem, private or public cloud, hybrid; no client or schema changes
Complete Database Protection
Everything you need to secure, monitor, and manage access to your database infrastructure.
Data Protection
Keep sensitive fields out of query results — without modifying your applications.
- Dynamic Data Masking (Full, Partial, Hash)
- Column-Level Access Control
- Response Leak Detection (OWASP CRS)
- Result Limiting (Rows/Bytes/Time)
- Query Result Truncation
Authentication
Put a verified human identity in front of every shared database account.
- Multi-Factor Authentication (TOTP)
- IP-Based Access Control
- Ident/Peer Authentication
Access Control
Least privilege enforced at query time — not just at login.
- Role-Based Permissions (RBAC)
- Object-Level Permissions
- User/Group Management
- Session Management & Ban
- Connection Limits per User/IP
Threat Prevention
Attacks are blocked inline, before they reach the database.
- SQL Injection Protection
- Dangerous Function Blocking
- Rate Limiting (Token Bucket)
- SQL Pattern Rules
- Application Fingerprinting
Audit & Logging
An attributable record of who did what — and why it was allowed or blocked.
- Complete Query Logging
- Centralized Application Logs
- Session & Transaction Tracking
- Block Reason Audit Trail
- GeoIP Location Tracking
Operations
Keep serving traffic through failures, maintenance and load spikes.
- Time-Based Access Rules
- Connection Pooling
- High Availability & Failover
- Read/Write Splitting
- Health Check Monitoring
What DSGuard protects against
Each of these is stopped by a control that runs inline on the request path — not by a report you read afterwards.
Credential theft
Stolen database credentials alone aren’t enough: MFA authenticates the human, and IP rules bound where they can connect from.
SQL injection
Injection patterns are matched against the extracted SQL before it reaches the database, and the attempt is blocked and logged.
Insider threat
Object-level permissions, time-of-day rules and application rules constrain what a legitimate account may do — not just whether it may connect.
Data exfiltration
Result limiting, query-result truncation and response-leak detection cap how much data any single session can pull out.
Privilege abuse
Dangerous-function blocking stops destructive and privilege-escalating statements even when the account technically holds the grant.
Unauthorized DBA access
Administrative sessions run under the same policy and audit as everyone else, and can be terminated live from the console.
Shared accounts
Per-user proxy logins put an identity in front of a shared service account, so activity is attributable to a person again.
Compliance violations
Dynamic masking keeps regulated fields out of results, and every decision is recorded with its reason for the audit trail.
Deploy Anywhere
Flexible deployment options to match your infrastructure and compliance requirements.
On-Premises
Your data center, your control
Private Cloud
Dedicated cloud infrastructure
Public Cloud
AWS, Azure, GCP compatible
Hybrid
Unified multi-environment
Built for
Securing critical database infrastructure for regulated companies.
Comprehensive Coverage
One platform for your entire database ecosystem.
Relational (SQL)
NoSQL
Analytical
* MariaDB is supported through the MySQL-compatible wire protocol.
Give AI agents a shell you can trust
The same inspect-and-enforce approach, applied to command execution. Operators and AI agents run commands through a sandboxed shell where every command is policy-checked, sensitive output is masked, and the whole session is recorded.
Command rules
Allow, deny or require approval per command — with a secure default-deny policy so nothing runs unless you permit it.
PII & column masking
Detect and mask secrets, PII and sensitive columns in command output before it ever reaches the caller — including format-preserving masking.
Network & egress control
Per-domain egress rules control exactly which hosts a session can reach — fail-closed when a rule can’t be applied.
Filesystem allowlisting
Landlock-based path allowlists and per-file access rules scope every session to exactly the files it is allowed to touch.
Live session control
Watch active sessions and revoke or ban one instantly — the enforcement is server-side, so a client cannot talk its way around it.
Complete audit
Every command, decision and masked result is logged with its identity and reason — the same audit discipline as the database gateway.
Controls that map to your obligations
DSGuard’s access control, masking and complete audit trail give you concrete, demonstrable evidence for the frameworks your auditors ask about.
| Framework | Control area | DSGuard control |
|---|---|---|
| PCI DSS | Req. 3.3 — Mask PAN when displayed | Dynamic masking keeps full PAN and other regulated fields out of displayed query results. |
| Req. 7 — Restrict access by need‑to‑know | Role-based and object-level permissions with a default-deny policy. | |
| Req. 8 — Identify and authenticate access | Per-user proxy logins with MFA/TOTP — in front of shared service accounts. | |
| Req. 10 — Log and monitor all access | Every query logged with identity, decision, block reason and GeoIP context. | |
| ISO 27001 | Access control | Centralized least-privilege policy across every supported database engine. |
| Operations security & logging | Continuous audit trail plus Prometheus metrics and Grafana dashboards. | |
| Communications security | TLS to clients and backends; Oracle Native Network Encryption support. | |
| SOX | Integrity of financial reporting data | Attributable record of who read or changed financial data, and under which rule. |
| HIPAA | PHI access & safeguards | Column-level restriction and masking of PHI, evidenced by continuous logging. |
| GDPR / KVKK | Data minimisation & accountability | Masking limits what is exposed; purpose-bound access rules and processing records. |
DSGuard provides technical controls and audit evidence that support these frameworks; it is not, by itself, a certification. Control-area names are given by theme, as framework numbering differs between revisions.
Start free, license when it matters
Download and run the full gateway with no licence and no registration — all features, no time limit. Move to a licence when you need more datasources, more ShellAI users, or support.
Community Edition
No licence · no registration
- One-command install — the full stack ships as a single all-in-one container, available on Docker Hub
- Up to 3 datasources
- Up to 3 ShellAI users
- All features included — SQL-injection blocking, dangerous functions, object permissions, masking and more, with no time limit
- MFA/TOTP
No expiry and no feature-gating — the full gateway stays protected. Add a licence when you need more datasources, more ShellAI users, or support.
Professional
Annual subscription
- All features included — the complete database gateway and AI Sandbox Shell, nothing feature-gated
- Capacity as licensed — datasources and ShellAI users up to your purchased counts, enforced by the licence
- Deployed by our engineers — every server and container is installed for you, with CPU, RAM and storage sized for your workload
- Software and detection-pattern updates throughout the subscription — installed for you by our engineers
- Business-hours support — Mon–Fri, 09:00–18:00 (GMT+4)
- Grow anytime — extend your licence to add datasources or ShellAI users
Enterprise
Annual subscription · custom terms
- Everything in Professional — all features, capacity as licensed
- 24×7 support with a 4-hour response target — around the clock, every day
- Custom licence terms — capacity, contract length and invoicing shaped to your organisation
Licensing is applied per service category — database proxies are counted by datasource, the AI Sandbox Shell by user. For pricing and evaluation terms, email us at dsg@ds-guard.com.