Skip to content

Database Proxy

The eXate Database Proxy acts as a transparent, high-performance middleware sitting directly between database clients (such as BI tools, applications, or developers) and the target database engines.

It intercepts raw SQL queries, dynamically rewrites them to inject security filters, and applies masking or tokenisation to the returned columns before they are sent back to the client.

Key Capabilities

  • Zero Application Changes: Requires no modifications to your existing applications; simply change the database connection host to point to the Database Proxy.
  • Dynamic Query Rewriting: Parses SQL statements on the fly using Apache Calcite to inject Row-Level Security (RLS) filters.
  • Column-Level Security (CLS): Dynamically masks or encrypts table column values according to active eXate Policies.
  • Multi-Database Support: Implements consistent, centralised governance rules across heterogeneous database environments (e.g., PostgreSQL, Oracle, SQL Server, Snowflake).

How It Works

sequenceDiagram
    autonumber
    App / Client->>Database Proxy: Submit SQL Query
    Database Proxy->>eXate Engine: Resolve RLS/CLS Policies for User
    eXate Engine-->>Database Proxy: Return Row Filters and Masking Rules
    Database Proxy->>Database Proxy: Rewrite SQL (inject filters/masking)
    Database Proxy->>Database: Execute Rewritten Query
    Database-->>Database Proxy: Return Raw Result Set
    Database Proxy->>Database Proxy: Apply Dynamic Masking to Columns
    Database Proxy-->>App / Client: Return Protected Result Set
  1. SQL Interception: The client sends a standard SQL query (e.g., SELECT * FROM employees;) to the Database Proxy.
  2. Policy Resolution: The Database Proxy requests active entitlements from the eXate policy engine based on the user's Active Directory groups or claims.
  3. SQL Rewriting: The query is parsed and rewritten. For example, if the user is only allowed to see the "HR" department, the proxy appends WHERE department = 'HR' to the query.
  4. Execution: The database executes the safe, rewritten query.
  5. Dynamic Masking: The proxy receives the database results, masks any sensitive columns (like salary or email) that the user is not entitled to see, and returns the protected dataset to the client.