Product
One secure engine, many form factors
AthenaDB is one engine, built from the ground up — delivered as an embeddable library on your device, a networked server, a clustered service, and a scriptable CLI. Same data, same powerful search, whichever shape you need.
AthenaDB Core
The secure engine everything is built on.
The heart of AthenaDB: an encrypted storage engine with a write-ahead log, B-tree indexes, snapshots, and backup/restore — with its own built-in cryptography. No third-party database or crypto library is bundled inside.
- Encryption at rest (own AEAD: ChaCha20-Poly1305, HMAC, SHA-256)
- WAL, B-tree, snapshots, integrity checks, backup/restore
- C ABI for embedding into applications
AthenaDB Lite
The engine embedded — an encrypted, offline-first local database.
AthenaDB with no server: an encrypted local vault with typed domain stores and the full hybrid-retrieval stack (keyword, vector, HNSW/IVF, timeline, entity). Built for desktop and edge.
- Offline-first encrypted local vault
- Keyword + vector (HNSW/IVF) + timeline + entity retrieval
- On-box embedding generation and re-embedding
AthenaDB Server
Multi-user server runtime with an admin API.
A networked instance serving multiple clients. The request-routing seam (health / query / ingest) exists today as an embedded server; the standalone daemon and multi-user surface are being built out.
- Request router (health / query / ingest)
- Standalone daemon in progress
- Admin API — roadmap
AthenaDB Cluster
Multi-node scale-out with high availability.
DAG execution, replication, sharding, failover, and multi-region placement. Planned — the licensing model already reserves cluster entitlements so editions won't need rework.
- Replication + sharding + failover
- Sentinel high-availability
- Multi-region placement
AthenaDB Sync
Lite-to-server two-way sync built on verifiable trust.
Device enrollment, remote seal/wipe, and scoped two-way sync between Lite and Server. The device-trust foundation ships today; the full sync protocol is in design on the Instance Trust Fabric.
- Device trust + remote seal/wipe (foundation)
- Scoped two-way Lite↔Server sync (design)
- Rides the Instance Trust Fabric
Athena CLI
A scriptable command line for the whole engine.
The `athena` CLI manages instances, ingestion, retrieval, licensing, the Trust Fabric, the SQL surface, and each domain pack — from one binary.
- `athenadb db` — init, status, check, backup, restore, compact, stats, repair
- `athenadb db trust` / `license`, `athenadb sql`, `athenadb import` / `ingest`
- `athenadb legal | medical | research` domain commands
SQLite drop-in compatibility
Run existing SQLite apps on AthenaDB — unchanged.
A native SQL parser/executor plus a SQLite-compatible C API and an `athenadb-sqlite3` drop-in CLI. Existing `-lsqlite3` applications can run on AthenaDB and gain encryption + AI-native retrieval.
- SQLite-compatible C API + `libsqlite3` shim
- `athenadb-sqlite3` drop-in CLI
- A migration path off SQLite, not a rewrite
Programmability
Server-side logic — the way a secure database should do it.
Domain packs already give you encapsulated, signed, permissioned server-side logic today. Saved views, reusable functions, and declarative event hooks are planned, so you can build the things you'd reach for stored procedures, views, and triggers to do — without running arbitrary code inside your database.
- Domain packs — signed, permissioned server-side logic (available)
- Saved views and reusable functions — planned
- Declarative event hooks instead of triggers — planned
Embedding engine
Pluggable embeddings for vector and hybrid retrieval.
A provider abstraction over external embedding services (Text-Embeddings-Inference / BGE-M3) and native Athena embeddings, with vector indexes, quantization, and re-embedding pipelines.
- Provider abstraction (TEI / Athena-Emb1)
- HNSW + IVF vector indexes, quantization
- Re-embedding pipelines
Native AI runtime
Attach a language model to your database — encrypted, in place.
A planned AI runtime built into AthenaDB rather than bolted on: models load from encrypted, signed packages into protected memory and run inside the database's own security boundary, so your documents and context never leave it. Run it in the database process, on a dedicated model machine you own, or point it at an outside provider when you choose to.
- Encrypted, signed model packages — keys custodied like your data
- Runs in place: prompts and context stay inside your boundary
- Or run the AI tier on its own machine over an encrypted link
Instance Trust Fabric
A secure cognitive trust mesh between database instances.
Instances authenticate each other with cryptographic identity, negotiate scoped roles, and exchange permission-filtered context — never raw remote SQL. Think Active-Directory-style trust for AI-native databases.
- Cryptographic instance identity (Ed25519)
- Directional, revocable, non-transitive trust policy
- Permission-filtered context packs, mTLS channels, dual-side audit
AthenaDB Studio
SSMS-class desktop admin for AthenaDB — plus licensing, trust, and packs.
Cross-platform Qt desktop app for local Lite vaults and remote Server connections (TCP/TLS and local IPC). Object Explorer, query editing, maintenance, and schema tools are in active pilot development; Licensing, Trust, Security, packs, and cognitive explorers remain roadmap. Until signed Studio installers ship, the CLI and account dashboard remain the supported public surfaces.
- Local + remote DBA: Object Explorer, query workspace, maintenance (pilot)
- Remote Server over ADR-0011 transports (TCP/TLS, Unix socket / named pipe)
- Licensing, Trust, Security, packs, and cognitive explorers — roadmap
SDKs & integration
Native clients for your language.
The shipped integration surface today is the C ABI and the SQLite-compatible C API. First-party language SDKs (with license-state APIs) are planned.
- C ABI (available)
- SQLite-compatible C API (available)
- Language SDKs — planned