Powered by
Emet
An inline zero-trust database security wire proxy that encrypts sensitive columns before write commit—so even a breached database yields no plaintext PII.
An inline zero-trust database security wire proxy that encrypts sensitive columns before write commit—so even a breached database yields no plaintext PII.
Emet is an inline, zero-trust database security wire proxy developed by DaTamoon Ltd. It transparently intercepts SQL queries to encrypt sensitive columns via AES-256-GCM before write commit, keeping cloud databases completely blind to plaintext PII without requiring code changes.
Emet combines four mechanics to keep plaintext PII outside the database while preserving normal application behavior.
Sensitive values are encrypted with authenticated AES-256-GCM before the database write commits, leaving only inaccessible ciphertext at rest.
A transparent SQL proxy intercepts queries in-flight, encrypting and decrypting protected columns on the wire. Your application and schemas remain unchanged.
Threshold approval policies prevent any single system or administrator from unilaterally gaining access to protected encryption keys.
Protect exactly the columns that matter—PII, credentials, financial fields—while the rest of your database operates at full native speed.
Sensitive values are processed ephemerally in volatile memory — never stored on physical disks — with zero noticeable delay.
SQL queries are intercepted and decrypted in secure RAM, introducing zero noticeable delay.
High-frequency transaction endpoints can bypass the proxy entirely to run at raw native speeds.
Synchronous real-time queries to national compliance registries keep regulated flows fast.
Native background DEK re-encryption across multi-column policies without locking transactions or disrupting traffic.
Assuming a 1% (p = 0.01) baseline risk of a single node compromise, threshold security shifts breach probability from a linear struggle to complete breach-nullification.
| Metric | Traditional Systems | Emet (2-of-3 Quorum) | Emet Enterprise (4-of-7 Quorum) |
|---|---|---|---|
| Breach Probability | P = p (1%) | 0.0298%33× reduction | 0.000003416%292,000× reduction |
| Risk Multiplier | Baseline | Exponential Reduction | Statistical Impossibility |
| Points of Failure | Single Point | Zero Single Points | Geo-Distributed Quorum |
| Target Value | High-Value Honeypot | Inaccessible Ciphertext (Breach-Nullified) | Inaccessible Ciphertext (Breach-Nullified) |
Scaling to the 4-of-7 tier provides a 292,000× risk reduction compared to traditional systems — achieving what DaTamoon defines as mathematical breach-nullification.
SELA and Emet solve two different halves of the same problem.
SELA secures the human element at the perimeter—verifying that the person interacting with your system is exactly who they claim to be, before access is granted. Privacy-first, AI-powered document and human recognition.
Emet secures the data itself in the backend vault. Even if the storage infrastructure is breached, sensitive information remains mathematically locked—your database never sees plaintext PII.
Emet deploys as an inline wire proxy between your application and database. With a modular DatabaseAdapter abstraction layer, Emet natively supports PostgreSQL and PostgreSQL-wire compatible engines (Amazon Aurora, Amazon RDS, Google Cloud SQL, CockroachDB, YugabyteDB), with MySQL and MSSQL adapters rolling out next. Existing schemas, ORMs, and application code continue to work with zero changes.
