Where credentials live, per connection method
| Method | Who connects | Where the credentials are |
|---|---|---|
| Direct | dbtempo’s managed runner connects to your database. | The password is sealed with a key only the collection worker can open: an X25519 key agreement and AES-256-GCM. The web application that stores it holds only the public half, so it cannot read the password back. |
| SSH tunnel | The managed runner connects through your SSH bastion. | The database password, the SSH private key and its passphrase are each sealed the same way. |
| dbtempo agent | The agent runs in your network and makes every database connection. dbtempo’s servers never connect to the database. | A password you enter in the dashboard is encrypted, handed to the agent in the reply to its own request, and written to the agent’s local config file, readable only by the agent’s user. Queue rows that carried it are deleted after a day. |
What a collection sends
Query statistics, example query text, schema and index metadata, execution plans and server configuration. A collection payload carries no table rows, and payloads are deleted after thirty days.
On MongoDB the collection sends query shapes with every value removed, plan summaries, index usage, collection sizes, and field names and types. It never sends document values, user names or client addresses.
Where you connect a repository, dbtempo keeps the file spans it needs to locate the queries it analyzes, not a copy of the repository.
The read-only guard
Every statement the analysis tools send to a database passes a statement-aware read-only guard. It blocks multi-statement payloads and any statement that could write or execute.
On PostgreSQL and MongoDB, plans are read without running the query unless a project owner turns on query execution for that project.
On MongoDB the guard checks each command as a whole document, not as text, and refuses anything that could write or execute code.
What stands between a recommendation and your database
- Permissions per project and per kind of change: Off, Ask me first, or Apply automatically. Everything starts off.
- Ask me first sends the change to the Awaiting approval queue; nothing runs until someone approves it.
- An allowed change still passes the safety gates, and you can limit changes to a maintenance window. Changes that briefly stall the server always need one.
- Every write attempted is on the database’s audit trail, including the ones a guardrail blocked. Plans that include it export the trail as CSV.
- Every applied change keeps the SQL that reverses it. Index removals are staged and reversible, and never happen in one step.
- Code changes open as draft pull requests through the GitHub App; dbtempo does not merge them. Code pasted into a thread never opens a pull request.
API keys
CLI API keys are checked against a SHA-256 hash. An AES-256-GCM encrypted copy is kept so the dashboard can show a key again.
Certifications
dbtempo holds no security certification and claims none. If a certification or an independent audit report is a requirement for you, ask before you rely on it.
Security questions, answered
Can dbtempo read my database password after I save it?
For a direct or SSH connection, the web application that stores the password cannot read it back: it holds only the public half of the key that sealed it, and only the collection worker can open it to connect. With the dbtempo agent, a password entered in the dashboard is encrypted, handed to the agent in the reply to its own request, and written to the agent’s local config file.
Does dbtempo copy the rows in my tables?
No. A collection carries query statistics, example query text, schema and index metadata, execution plans and server configuration, and no table rows. Collection payloads are deleted after thirty days.
Can dbtempo change my database without asking?
Not unless you allow it. Each project sets every kind of change to Off, Ask me first or Apply automatically, and everything starts off. An allowed change still passes the safety gates, and every write attempted is on the database’s audit trail.
Can an analysis run a destructive statement?
No. Every statement the analysis tools send to a database passes a read-only guard. The statement-aware guard blocks multi-statement payloads and any statement that could write or execute.
Does dbtempo hold a security certification?
No. dbtempo holds no security certification and claims none. If a certification or an independent audit report is a requirement for you, ask before you rely on it.