Security
Designed to observe infrastructure, not customer data.
DatabaseMeter’s security boundaries start with server-side identity and ownership checks, then keep every credential and provider operation behind the application boundary.
Authentication and ownership
Auth0 establishes identity. DatabaseMeter maintains a local user record keyed by immutable Auth0 subject and checks ownership server-side for every user-specific resource.
Credential protection
Neon, Supabase, and optional PostgreSQL telemetry credentials are validated server-side and encrypted with AES-256-GCM under a separately versioned environment key before persistence. Saved secrets are never returned to the browser.
Direct PostgreSQL destinations
Direct connections are disabled by default, require certificate-verified TLS, reject private or mixed DNS destinations, and pin each connection to an address validated server-side while preserving hostname certificate checks. Bounded provider CA certificates are parsed and encrypted with the credential; Unix sockets, multiple hosts, client certificates, and routing overrides are not accepted.
No customer row collection
Normal monitoring is limited to provider metrics, catalogs, statistics, sizes, and activity metadata. Application table-row contents are outside the collection model.
PostgreSQL Health Check
Manual Health Check input remains in the browser. A signed-in user can alternatively select an owned telemetry connection; the server repeats ownership checks and runs fixed bounded statistics queries through the existing read-only, DNS-pinned, certificate-verified collector. Only the strict result payload returns, credentials remain server-side, and the report is not persisted.
Query-counter analyzer
The pg_stat_statements analyzer accepts bounded local exports and discards SQL-text columns before creating a report. Its optional connected path lists only eligible owned connections and returns fixed aggregate counters through the existing protected collector without exposing credentials or persisting the one-time analysis.
On-demand AI analysis
An authenticated user must explicitly choose a predefined analysis and database scope. The server repeats ownership checks, builds a bounded prompt-specific context, excludes credentials, connection strings, hostnames, role names, SQL text, application rows, and raw provider responses, and sends no model tools or database access. Results must pass a strict schema and cite supplied evidence identifiers. Suggestions are advisory and cannot execute changes.
Operational email
Weekly reports are explicit opt-in, use the verified email synchronized from Auth0, and are built from stored monitoring data. Outbound delivery and its shared scheduler have separate server-side activation switches. Delivery history stores provider message identifiers and allowlisted status details, not provider API keys or raw responses.
Disconnect and delete
Users can disconnect individual provider or telemetry connections and permanently delete DatabaseMeter-owned account data. External provider keys must still be revoked with the provider, and the upstream Auth0 identity is retained.
See the whole portfolio clearly.
Checking your secure session…