Security for a tool that touches your databases.
How ClusterEye is deployed, who can reach what, how data is protected and how the software is shipped — every item rests on the product's own controls.
Deployment and data location
You decide where and how ClusterEye runs.
Your infrastructure or SaaS
Installs on your own servers — air-gapped environments included — or runs as SaaS.
Offline licence
The licence can be activated without an internet connection, from a signed licence file.
Outbound-only agent
The agent opens no listening port on the monitored host; it only connects out to the ClusterEye server.
Port matrix →Access control
Roles decide who can see and change what.
Four roles, read-only by default
Admin, DBA, Auditor and Viewer roles. Write operations are denied by default and opened only where the role allows them.
LDAP login
Users sign in with your corporate directory (Enterprise).
Two-factor authentication
TOTP two-factor authentication, which can be made mandatory for chosen roles.
Data protection
Connections and credentials are protected; monitoring accounts only read.
Encrypted transport
Traffic between the agent and the ClusterEye server can be TLS-encrypted; the standard install terminates TLS at nginx.
Encrypted connection details
Database connection details are stored encrypted; the encryption key can be changed with a rotation command.
Read-only monitoring accounts
Monitoring accounts only read; the privileges each engine needs are listed one by one in the docs.
Privilege list →Audit
Actions in ClusterEye and database activity are on the record.
Tamper-evident user log
User actions are written to an audit log in which every entry is chained to the previous one by hash.
Database activity monitoring
Oracle and SQL Server activity is recorded with a risk score (Enterprise).
Activity monitoring →Software supply chain
Agent updates are installed only when their signature verifies.
Signed agent updates
Agent updates are signed with ed25519; an update whose signature does not verify is not installed.
Independent testing
The product's security has been tested from the outside.
Penetration test
The product has been through a penetration test by an independent security firm. The report and the status of its findings are shared under NDA.
Security contact
For security questions and finding reports.
Write to us
Contact our team for a security review, an NDA report request or to report a finding.
Contact →Let's answer your security team's questions together.
We'll walk through the architecture, data flow and access model on your environment.