The Managed Plan
How DBTrail Managed works. The trust boundary, the security model, and what DBTrail stores when it operates the index for you.
On the Standard plan you run DBTrail EE yourself. On Managed, DBTrail provisions, sizes, upgrades, backs up and monitors the index infrastructure, the store that holds your change history. In the free core that job is yours: support scope.
Read-only by design
DBTrail never writes to your source database, Managed included. It connects as a replication client, the footprint of one replica. Recovery produces SQL a person reviews and applies.
The trust boundary
- Your database stays yours: read-only replication client, connectivity from your side outbound only.
- The index runs on DBTrail-operated infrastructure in a private VPC. Those hosts have no public IP addresses.
- With BYOS (part of DBTrail EE), full before/after row images go as Parquet to an S3 bucket you own: your KMS key, bucket policy and lifecycle, revocable any time.
What DBTrail stores
With BYOS, DBTrail's side keeps:
- Connection metadata: hosts, ports, replication positions.
- Credentials (MySQL passwords, DSNs, SSH keys), encrypted.
- A metadata index per change: schema, table, event type, timestamp, a SHA-256 hash of the primary key, changed column names, GTID, connection id, row count. No row values and no key values.
- A request audit log: who, what, when, result.
Row and key values stay in your bucket. Queries and recovery decode matching events in memory and do not persist them. Without BYOS, the full index, row images included, lives on the operated index store.
Security model
- In transit: TLS for external traffic. S3 over HTTPS with IAM roles, no static keys. Internal calls stay inside the private VPC and are authenticated.
- At rest: stored credentials are encrypted with Fernet (AES-128-CBC with HMAC), the key held apart from the database.
- Secrets: environment configuration only, never in code or images. Authorization headers stay out of request logs. Processes run as non-root users.
- Your users: EE RBAC and column redaction decide what they can see and recover.
Compliance and getting Managed
The controls above map to SOC 2, HIPAA, PCI-DSS and GDPR on the compliance page. Managed is not self-serve: write to contact@dbtrail.com or join the waitlist on the pricing page. Plan comparison: DBTrail EE & Plans.