Question 1

How does PgBeam enforce what an agent can do?

Accepted Answer

Enforcement happens in the PostgreSQL wire protocol, between the agent and your database. PgBeam parses every statement an agent sends, checks it against the policy attached to that credential (read-only, table allowlists, masking, budgets), and only forwards it if it is allowed. Blocked statements never reach your database.

Question 2

Does PgBeam work with my Postgres?

Accepted Answer

Yes. Enforcement is at the wire, not inside the database, so PgBeam works with RDS, Aurora, self-hosted Postgres, or any managed provider. There is no extension to install and no change to your schema.

Question 3

Do I need to change my code?

Accepted Answer

No. The agent gets a scoped connection string or a hosted MCP URL. Every PostgreSQL driver, ORM, and agent framework works unmodified. Your own application keeps using its existing connection untouched.

Question 4

How does PII masking work?

Accepted Answer

You name the columns to protect and choose redact, null, or hash. PgBeam rewrites those values in the result before they leave the wire, so the agent receives masked data it can still join and group on. Your application reads the real values.

Question 5

Can I revoke an agent's access?

Accepted Answer

Yes, instantly. Revoke a single credential or hit the kill-switch to stop one agent or every agent on a project. The next statement is refused. No credential rotation and no database changes required.

Question 6

What is in the audit log?

Accepted Answer

Every statement an agent runs, allowed or blocked, with the decision, reason, rows, bytes, latency, and credential. Filter and export it in the dashboard. Recent entries are queryable in the control plane and archived for retention.

Question 7

What MCP tools does the hosted endpoint expose?

Accepted Answer

Eight tools: query, validate_sql, list_tables, describe_table, explain, and schema_catalog, each enforced against the same policy engine as the connection string, plus search_docs and read_doc for looking up how PgBeam works. An agent connected over MCP gets the same guardrails. Paste the URL into Claude Code, Cursor, or any MCP client. No install.

Question 8

Is there an SLA or uptime guarantee?

Accepted Answer

Uptime commitments and support terms are part of Enterprise plans. Contact sales@pgbeam.com to discuss an SLA for your team.

Question 9

What happens if I exceed my limits?

Accepted Answer

Overage is billed at $0.10 per 1K queries above your daily limit on all plans. Data transfer overage is $0.20/GB on all tiers. No surprises: usage is tracked in your dashboard.

Question 10

Can I switch plans at any time?

Accepted Answer

Yes. Upgrade or downgrade any time from your dashboard. Upgrades take effect immediately. Downgrades take effect at the end of the current billing period.

Question 11

Does the gateway add pooling and caching?

Accepted Answer

Yes. The gateway runs on a globally distributed wire-protocol proxy, so agent traffic gets connection pooling (which absorbs the connections agents leak) and optional query caching (which absorbs the questions they re-ask) at no extra setup.

Question 12

Can I self-host PgBeam?

Accepted Answer

Yes, on the Scale and enterprise plans. The self-hosted (BYOC) data plane runs the PgBeam proxy inside your own VPC or cluster, so agent traffic and your database credentials never leave your network, while the control plane, policy engine, and dashboard stay hosted by PgBeam. The proxy dials home only to fetch policy config and ship the audit trail. See the self-hosted data plane docs to enroll.

Simple, transparent pricing

Starter

Pro

Scale

Need custom limits?

Frequently Asked Questions

Get started in 30 seconds