Encrypted in transit and at rest, an identity on every connection, a record of every change. Each layer is a setting you can read.
From the network edge to the record on disk, each with the configuration that turns it on.
Every listener binds to 127.0.0.1 until you say otherwise. A process that would listen on a public address without TLS refuses to start.
# default: every listener binds to 127.0.0.1
# going public is an explicit act:
Node__ListenAddress=0.0.0.0
# ...and without TLS the process refuses to start
# unless you opt in on purpose:
Tls__AllowInsecureTransport=falseOne switch turns on TLS for every listener and every internal connection. A built-in cluster CA issues short-lived certificates, rotated for you, that carry SPIFFE identities.
Tls__Enabled=true
Tls__RequireClientCertificate=true
Tls__CaPath=/etc/colibri/ca.pem
# identity in every certificate (SAN URI):
# spiffe://colibri/process/node/node-1Data users get rules per key prefix: deny by default, longest prefix wins. The ACL file is signed with HMAC-SHA256 and verified before a node applies it.
ProxyAuth__Type=Acl
// acl.json (signed with HMAC-SHA256)
{ "prefix": "billing:", "read": true,
"write": true, "admin": false }
// deny by default, longest prefix winsPeople sign in through your identity provider: Entra ID, Okta, Keycloak, Google. Authorization code with PKCE, roles from group claims, lockout after repeated failures.
// Security > Single sign-on
{ "enabled": true,
"authority": "https://idp.example.com",
"roleClaim": "groups",
"roleMapping": { "sec-admins": "Admin" },
"sessionHours": 8 }Cap keys and bytes per tenant prefix. A tenant at its limit gets a clear error, and a noisy neighbour cannot eat the node.
// tenant = text before the first ':'
"tenants": [{ "prefix": "acme",
"maxKeys": 1000000,
"maxBytes": 5368709120 }]
// over the limit: HTTP 507 urn:colibri:quota-exceededEvery sign-in and every mutating action is appended to the audit log. Audit log export is part of the Enterprise plan.
data/audit/*.jsonl # append-only
sso.login sso.denied
tls.rotate tls.ca.regenerate
tenant.quota.update
# every sign-in and every mutating actionAES-256-GCM on every record, one data key per shard, wrapped by a key you control: a local KEK or HashiCorp Vault Transit, with online rotation. Enable it, rotate keys and turn it off from Admin; a key rotation does not restart the nodes.
Node__Encryption__Enabled=true
Node__Encryption__Vault__Address=https://vault.internal:8200
Node__Encryption__Vault__KeyName=colibri
# AES-256-GCM per record
# one DEK per shard, wrapped by your KEK
# or manage it in Admin: Storage > Encryption at restThe limits of the current release, stated plainly.
Regions. A hosted trial runs in the region you pick, and its cluster and data stay there until it is deleted. Your sign-up details (name, email, company) are handled by our site and sales systems, not in the trial cluster. This says where a trial runs; it is not a compliance certification.
Report a vulnerability privately to our security team by email, and please do not post it publicly. We confirm receipt and keep you informed until it is fixed.
Security contact: security@colibridb.com
3
business days to acknowledge your report.
10
business days to an initial assessment.
30/ 90
days to a fix or mitigation: 30 for Critical and High, 90 for Medium and Low.
Book a security briefing. We will go through the layers, the failure tests and the deployment you have in mind.