PgBeam sits in the critical path between your application and your database. We take that responsibility seriously.
Last reviewed: July 24, 2026
PgBeam is in early access. Every control on this page is enforced in the PostgreSQL wire protocol today. The items in the roadmap below, including SOC 2 Type II, are in progress and labeled as such.
All connections use TLS 1.2 or higher. Client-to-proxy and proxy-to-database connections are encrypted in transit. SNI-based routing ensures traffic reaches the correct project without exposing data.
PgBeam never stores your database user passwords. Application credentials are passed through transparently to your upstream PostgreSQL database, which performs authentication directly. PgBeam only stores the origin database connection details you configure in the dashboard.
All persistent data is stored on encrypted infrastructure, with encryption at rest across both the control plane and the globally distributed data plane. Database credentials for origin connections are encrypted at the application level before storage.
PgBeam runs data planes in multiple regions worldwide. Each client is routed to the nearest region, and cached query results stay within the region where they were generated. They are never replicated across regions.
Organization-based RBAC with owner and member roles. Scoped API keys for programmatic access. Session management with automatic expiration. SSO via SAML and OIDC for enterprise accounts.
PgBeam processes queries in memory for routing and caching decisions. Query content is not logged in production. Cached results are stored in-memory (L1) and in regional shared caches (L2) with configurable TTLs.
Beyond transport and storage, PgBeam enforces what each credential can do in the PostgreSQL wire protocol, then records every decision in a tamper-evident log.
Redact, null, or hash sensitive columns in flight, by schema.table.column. The agent gets masked values it can still join and group on; your own application reads the real data.
Allow the exact schemas and tables a credential may touch, and block writes and DDL per credential. Off-list or disallowed statements are rejected before they reach your database.
Per-statement-type allow and deny lists, row-level WHERE filters, query-count budgets, row caps, and statement timeouts, all enforced in the wire protocol on the same credential.
Stop one credential or every agent on a project instantly. The next statement is refused, with no credential rotation and no change to your database.
Every statement is recorded with its decision and reason. Entries are hash-chained with SHA-256, so editing or deleting any row breaks the chain. A verify endpoint recomputes the chain and reports the first broken entry.
Stream audit events to your systems in real time: HMAC-signed webhooks for any endpoint, plus native Splunk HEC, Datadog, and Elastic formats.
Baseline each credential's behavior and alert on drift, with an optional automatic kill-switch when an organization-level ceiling is breached.
We are actively working toward these milestones.
If you discover a security vulnerability, please email security@pgbeam.com. We take all reports seriously and will respond promptly.