Most security tools tell you about a problem after the damage is done. DBSheriff catches it while it is happening — every statement on your databases is seen, scored within seconds, and a confirmed threat is stopped before a customer record, a financial file or a trade secret leaves the building. It runs inside your own network. We never see your data, and neither does anyone else.
Full product, every engine, 30 days · Download link arrives by e-mail · Runs on-prem or in your AWS, GCP or Azure account
DBSheriff is deployed entirely within your own private network — your AWS VPC, GCP VPC, Azure VNet or on-premises data centre. No outbound connection is required at runtime. No query text, no user identity, no schema name, no event record and no credential ever leaves your security perimeter. This is not a configuration option. It is the only way DBSheriff operates.
Most database security tools need weeks of quietly watching your traffic before they know your environment well enough to say anything useful. DBSheriff works differently: the moment you connect a database it runs a full posture check and hands your team a plain-English report — no waiting, no learning period. Think of it as a home inspection for your database.
You get a real answer to “is our data safe right now?” in the first five minutes. Every finding is informational: nothing on your systems changes until your own team turns an action on. Passes are recorded too, so the report is evidence, not just a to-do list.
Your log-monitoring tools (a SIEM) catch odd behaviour after it is recorded in a log. Your data-leak protection (DLP) stops files at the network's edge. These are important, well-built layers, and DBSheriff is not here to replace any of them. It fills the one gap they all share: the moment a database statement is actually running, before anyone else notices.
The only moment that matters is while the statement is still running. That brief window, often a few seconds, is the only point where a threat can still be stopped, and it is a blind spot for every other tool you own. That is the moment DBSheriff was built to catch.
| Security layer | What it covers | 🔒 DBSheriff's role |
|---|---|---|
| Firewall / access management | Controls who can reach your network and log in | Complements — catches abuse of already-authorised connections |
| SIEM / log analytics | Detects anomalies in historical log data, after the fact | Complements — acts in real time while the statement is still running |
| DLP (data loss prevention) | Flags exfiltration at the network edge, after the query completes | Complements — terminates the statement before data reaches the edge |
| The live query window | Not covered by any of the above | DBSheriff — this is the gap it was built for |
DBSheriff connects to each database with a few ordinary, read-mostly accounts and reads the same views and audit trails your DBAs already use. Nothing is installed on the server. What it does with that is the same on every engine.
New installations run in detect-only mode. You see exactly what DBSheriff would have stopped before you let it act. Every action — terminate, revoke, lock, write a tag — is a switch you turn on per server, is reversible, and is written to an audit table you can read. DBSheriff never changes your data, roles or settings on its own.
Most businesses run more than one kind of database. DBSheriff covers them through one platform — same protection, same setup, same console. Each engine gets a security pass built on its own native audit and security features, on-premises and in the managed cloud service alike. The per-engine setup guides list every prerequisite and the monitoring accounts to create.
A licence names the engines you use; the trial has all of them. See the full engine-by-engine feature comparison, tested against real, live infrastructure on every one. Setup guides for each engine are provided directly once you're a customer.
DBSheriff is a set of containers on one Linux host that you control. The host can sit on-premises or be a VM in your own AWS, GCP or Azure account; the databases it watches can be anywhere. The guided installer verifies the signed release, loads the images and walks you through the first server.
Sent directly once you're a customer or trial user — not published publicly.
A single data breach can be company-ending for financial services, healthcare and government organisations. DBSheriff gives you a definitive answer when an auditor asks whether access to sensitive data was actively watched and controlled — and because everything stays inside your own network, adding it does not add compliance paperwork of its own.
PCI DSS 4.0 · SOC 2 · NIST 800-53 · CIS benchmarks per engine · and the access-control evidence HIPAA and GDPR reviews ask for · your own database access policies
Try the full product on your own host for 30 days — every database engine, no licence file, nothing leaves your network. Or let us walk you through a live demonstration and show you exactly where DBSheriff sits alongside your existing security tools.
Work e-mail required for the trial · No commitment · NDA available before any technical discussion
DBSheriff is built by Sun AI and Data LLC, Concord, California. Its founder brings 20+ years in data engineering and cloud architecture, including building and leading systems that process over 160 billion transactions a year at Mastercard (Brighterion) and a $120M merchant risk and fraud platform deployed across four global regions. Real-time scoring of every event, evidence you can hand to an auditor, and nothing leaving the perimeter are not new ideas to us. They are how we have always had to work.
Want a private walkthrough of DBSheriff on your stack, help with a trial install, or a licence quote? Write to us. We reply within one to two business days.
Response within 1–2 business days · NDA available on request