Documentation

Happy CISO Docs

How the MPC-SQL database security layer works: proxy architecture, mathematical shredding, split-brain storage, supported databases, and deployment.

Architecture Mechanism Supported Databases Deployment

Architecture

An Inline Proxy, Not a Platform Migration

Happy CISO sits as a transparent MPC-SQL proxy between your application and your database. Queries pass through unchanged; protected columns are encrypted on the way in and decrypted on the way out. Your schemas, ORMs, and application code stay exactly as they are.

Application Tier

Your application connects to Happy CISO exactly as it would connect to the database—same drivers, same connection strings, same queries.

MPC-SQL Proxy

The proxy intercepts queries in-flight, applies selective column-level encryption to protected fields, and mathematically shreds sensitive values into fragments.

Storage Tier

Fragments are distributed across separated domains (split-brain storage). The database itself only ever holds ciphertext for protected columns—it stays blind to plaintext PII.

Mechanism

The Four Mechanics of MPC-SQL

Zero-Knowledge Mathematical Shredding

Sensitive values are shredded into fragments that reveal nothing on their own. No single fragment—and no single fragment holder—can reconstruct the original data.

Proxy Intercepts

Encryption and decryption happen on the wire, transparently. Reads and writes to protected columns work as normal from the application's point of view.

Split-Brain Storage

Fragments live in separated domains, so no single system or administrator ever holds enough material to recover plaintext—including your own DBAs.

Selective Column-Level Encryption

You choose exactly which columns to protect—PII, credentials, financial fields—while the rest of the database runs at full native speed.

Compatibility

Supported Databases

Happy CISO deploys in front of the storage engines you already run—relational, document, cache, and warehouse.

Oracle

MySQL

Microsoft SQL Server

PostgreSQL

MongoDB

Snowflake

Redis

Databricks

IBM Db2

Elasticsearch

And more…

Deployment

No Rip-and-Replace. No Schema Changes.

Deployment is a connection-string change, not a migration project. Point your application at the Happy CISO proxy, declare the columns to protect, and plaintext disappears from your storage tier—at rest and in transit.

1. Connect

Route your application's database connection through the MPC-SQL proxy

2. Declare

Select the sensitive columns to protect—PII, credentials, financial data

3. Encrypt

New writes are shredded and encrypted transparently; existing data can be migrated in place

4. Verify

Confirm your database holds no plaintext for protected columns—there is nothing left to breach