Security
Read-only by default. On-prem. You decide what gets applied.
Every architectural decision in dbexpertAI answers to one constraint: connecting us to your database must be a no-risk action. Here is exactly what that means.
read-only
Diagnosis only reads
You create the credentials; for diagnosis they carry read permissions only. The agent never writes its own code against your database, and it can never do more than the database user you provide is allowed to do.
on-prem
Data stays home
The agent runs inside your network and detection paths execute locally. Table contents are never shipped out — in any configuration. At most, the analysis result leaves, and only if you opt into the SaaS layer.
deterministic
Auditable behavior
Detection paths are written-down diagnostic logic, not model weights. What the agent checks, in what order, is documented and reviewable — same input, same output.
The objection this page exists to kill
"You want to connect what to production?" is the right first question for any
database tool. Our answer: an agent that (1) diagnoses with credentials which physically
cannot mutate state, (2) runs on hardware you control, inside your perimeter, and (3) at most
sends out conclusions — never contents. The blast radius of a compromised or misbehaving
dbexpertAI agent is bounded by what a read-only user can see — and that bound is one
REVOKE away from zero, entirely in your hands.
How a fix gets applied
The agent does not decide what runs. Every fix is pre-written and approved by database experts. Simple fixes that are safe can run directly. Anything critical is suggested to your DBA, who approves it and runs it. You decide what gets applied.
Deployment shape
One agent per network segment, deployed as a container or a systemd service. No inbound ports, no VPN peering, no agents on your application hosts, no schema changes, no query instrumentation.
Two shapes, and you choose:
- Self-contained. The agent runs and reports entirely inside your perimeter. Nothing leaves your network — not contents, not conclusions.
- With the SaaS layer (optional). The agent opens an outbound TLS connection and delivers analysis results only — root cause, evidence summary, resolution steps. This is what buys you chat, phone notifications, and access to your diagnoses from anywhere. Results are encrypted in transit and at rest, and hosting can be pinned to your country. Talk to us about your jurisdiction.
Security FAQ
Asked by every security review
- Can dbexpertAI change my database?
- Only in ways your team allows. Diagnosis runs with read-only credentials that you create and control. The agent never writes its own code against your database: every fix is pre-written and approved by database experts. Simple fixes that are safe can run directly; anything critical is suggested to your DBA, who approves it and runs it. A fix can only do what the database user you provide is allowed to do, so with a read-only user nothing can be changed. Revoke the user and the agent is fully disconnected.
- Does my data leave my network?
- Your database contents — table rows, business data — never leave, in any configuration. Detection paths execute on-prem, where the data lives. The only thing that can leave is the analysis result itself (root cause, evidence summary, resolution steps), and only if you opt into the SaaS layer. Run the agent standalone and nothing leaves your perimeter at all.
- What is the SaaS layer, and is it optional?
- Entirely optional. It is what gives you chat, phone notifications, and access to your diagnoses from anywhere rather than only from inside your network. Enabling it means analysis results — never table contents — are transmitted to it. Decline it and dbexpertAI runs fully self-contained.
- How are analysis results protected, and where are they hosted?
- Encrypted in transit and at rest. Hosting can be pinned to your country for data-residency requirements. Talk to us about the specifics for your jurisdiction — regional hosting is arranged per customer.
- What does the agent actually read?
- System catalogs, statistics views, performance counters, configuration, and log-derived signals — the operational surface a DBA reads during an investigation. Detection paths target operational state, not your business rows.
- Can diagnostics load my production database?
- Detection paths are lightweight catalog and statistics reads, budgeted per cycle. They are the same queries a careful DBA runs on production systems — reading pg_stat_* views does not take locks on your tables.
- Who sees my diagnoses?
- Your team. We do not resell, aggregate, or train on your operational data.
Run it past your security team.
Send them this page. If they have a question it doesn't answer, we'll answer it directly — and add it here.
Free for your first database, forever. No credit card. No strings attached.
Runs on Windows, macOS and Ubuntu, inside your network. You decide what gets applied. Enterprise fleet or want humans in the loop beyond setup? Talk to us.