---
title: "Security at PgBeam"
description: "How PgBeam secures agent access to Postgres: scoped revocable credentials, least privilege at the wire, PII masking, a hash-chained audit trail, and TLS throughout."
canonical: "https://pgbeam.com/security"
last-updated: "2026-09-15T20:29:04.849Z"
---

# Security at PgBeam

PgBeam is the policy and audit layer between AI agents (or humans) and your Postgres. Enforcement happens in the PostgreSQL wire protocol.

- Credentials: per-agent, scoped, revocable, with a per-credential and project kill-switch. SCRAM-SHA-256 auth (cleartext-over-TLS fallback).
- Least privilege: read-only enforcement, table allowlists, row-level policies.
- PII masking: redact, null, or hash columns before results leave the wire.
- Audit: every statement recorded with its decision and reason; webhook and SIEM export.
- Transport: TLS throughout. Your real database credentials never leave PgBeam.

See https://pgbeam.com/security and https://pgbeam.com/docs.