Security
Secure by construction
AthenaDB was built security-first: its own encryption, no third-party datastore, verifiable trust between instances, and enforcement designed so licensing never touches your data.
Encryption at rest, our own stack
Data is encrypted in the storage engine with AthenaDB's own AEAD primitives (ChaCha20-Poly1305, HMAC, SHA-256) and page-level encryption keyed from the superblock. Because we own the format and crypto, they are ours to audit and control.
No embedded third-party database
There is no SQLite or bundled datastore inside AthenaDB. The storage format, indexes, and cryptography are ours end to end — a single, auditable surface, not a stack of other people's databases.
Access control that fits your org
Role-based access control — users, roles, groups, and object-level permissions (grant and revoke), with the same model on every platform. Connect it to Active Directory or Entra ID so your existing users and groups map straight to database roles, whether the server runs on Windows, macOS, Linux, FreeBSD, or Solaris.
Privacy-preserving licensing
The licensing service never sees your documents, queries, embeddings, or domain records. Device binding uses salted one-way hashes, never raw hardware serials by default.
Verifiable inter-instance trust
The Instance Trust Fabric authenticates instances by cryptographic identity over mutually-authenticated, encrypted channels, returns permission-filtered context instead of raw access, and audits every decision on both sides.
Hash-chained, exportable audit
Licensing lifecycle events and every trust decision are written to append-only, hash-chained audit logs that are SIEM-exportable — tamper-evident by construction.
In-engine real-data clearance gate
Ingesting real (sensitive) data is blocked in the engine until a signed clearance attestation — naming the reviewer and the crypto and storage-format review it covers — is recorded and cryptographically verified against your configured trust anchor. It is enforced in code rather than policy, and it fails closed: no valid attestation, no real-data ingestion.
Reporting a vulnerability
If you believe you've found a security issue, please email [email protected] before disclosing publicly. During Early Access we ask you to evaluate AthenaDB on synthetic or non-sensitive data. Real-data mode is not a switch we flip for you — it opens when your deployment records a signed clearance attestation for the review described above, and the engine verifies it.