PostgreSQL wire proxy

Enforce before PostgreSQL executes.

Place Safe Boundary between an application, ORM, psql session, or database tool and PostgreSQL. It understands the wire protocol and SQL structure, then blocks or rewrites requests before they reach the database.

Get early access
Review the security model →

Why this exists

Add a policy boundary without a database extension

In default passthrough mode, PostgreSQL authentication is relayed and the database still sees the caller’s upstream role. Existing grants and row-level security stay in force.

Observe mode records what policy would do while forwarding unchanged traffic. Enforce mode activates read-only blocking, masking rewrites, dangerous-function denial, and fail-closed handling.

What it does

Concrete controls, stated precisely.

01

Protocol-aware

Handles PostgreSQL startup, TLS, authentication, simple queries, prepared statements, and common driver behavior on the wire.

02

RLS-safe default

Passthrough authentication preserves the PostgreSQL role, so grants and RLS remain authoritative for row access.

03

Fail-closed enforcement

Syntax errors, non-read-only statements, unsafe functions, and unredactable protected output are refused in enforce mode.

How it works

A visible enforcement sequence.

  1. 1

    Deploy

    Run the proxy beside the workload or in the same private network as PostgreSQL.

  2. 2

    Point

    Change host and port while retaining the upstream database identity.

  3. 3

    Observe

    Exercise real traffic and inspect would-block and would-mask events.

  4. 4

    Enforce

    Activate policy after the rules match the intended access path.

Protected when

  • ✓PostgreSQL connections routed to the proxy
  • ✓Eligible reads covered by configured masking rules
  • ✓Unsafe SQL and dangerous functions recognized by the parser

Important boundaries

  • —The proxy is not a connection pooler
  • —Direct PostgreSQL endpoints must be isolated separately to prevent bypass
  • —SCRAM-SHA-256-PLUS cannot be relayed through a terminating TLS proxy

Continue the story

Related Safe Boundary pages

Architecture →

See how the three enforcement surfaces share policy and audit semantics.

Security model →

Understand trust boundaries, credentials, identity, and bypass conditions.

Preserving RLS →

See which paths keep database row policy intact.

Test the boundary on a real access path.

Start in observe mode, validate the policy against representative traffic, and move to enforcement with explicit bypass controls.

Get early access