Install

Secure because it stays in your network

SkelaDB runs inside your VPC. Your data, keys and backups stay in the account you already audit.

Report a vulnerability

Nothing leaves your account

Every service, database and backup runs in your cloud account, and nothing is routed through ours.

  • Per-project roles, keys and bucket prefixes
  • An audit trail of every change
  • No telemetry, and a license checked offline
SkelaDB runs entirely inside your cloud account: your apps and agents connect through the proxy to branch computes, which read and write storage in your own bucket under your own keys. SkelaDB only ships container images.your-cloud-account / vpc-proda compute per branchYour appsdrivers, ORMsAI agentsMCP, CLIProxyTLS, poolingWAL service3 nodesPageserverany page, any timeYour keysKMSmain2 CUpr-12840.25 CUagent-7f3aasleepYour object storageS3, GCS or Blob, encrypted with your keysSkelaDBimagesOnly images come in. No data goes out.

Protected in transit and at rest

Each layer checks who is talking to it and keeps what it wrote.

Encrypted connections

Clients connect over TLS with SCRAM-SHA-256. The proxy relays the exchange and never sees a password; database passwords are kept in your cluster's Secrets.

Authenticated services

Internal services refuse any connection without mutual TLS or a shared secret.

Durable commits

In the default storage mode a commit is confirmed only after two of three WAL nodes have written it to disk.

History that cannot change

Stored layers are written once. A restore reads what was already there.

No telemetry leaves your account. Your license is a signed key checked offline. If it lapses, running databases keep serving and new branches are refused until you install a valid key.

Report a vulnerability

Email security@skeladb.com. This is the only address for security reports.

What to send

Write to security@skeladb.com with the affected release version and image digest, what an attacker can do, and the steps to reproduce it. Do not open a public issue. If you need an encrypted channel, say so in a first message without details and we will set one up.

What we do

  • We acknowledge your report within 2 business days.
  • We send a first assessment, including severity, within 5 business days.
  • We update you at least every 7 days until it is fixed.
  • We ship fixes as patch releases and describe them in the release notes, with credit to you if you want it.

Coordinated disclosure

Please give us 90 days, or until a fix is released if sooner, before you publish. If we need longer we will explain why and agree a date with you.

Safe harbor

Research in good faith on an installation you own or are authorized to test is welcome, and we will not pursue legal action over it. Do not access, change or delete data that is not yours, do not degrade services other people rely on, and do not use social engineering or physical attacks.

Scope

In scope: SkelaDB container images, the installer and manifests, the console, the CLI and MCP binaries, and skeladb.com. Out of scope: third-party services such as WorkOS or your cloud provider, volume denial of service, and findings that need cluster-admin access you would not otherwise have. We do not run a paid bug bounty yet.

Machine-readable contact: /.well-known/security.txt.

Questions about security?

Talk to the people who built it.

Email security Read the install guide