.ch
Governed by Swiss law · Zürich
The curved concrete wall of the Contra dam, Val Verzasca
A secure database engine

Immutable by construction.

VaultDB is an encrypted database engine: every record sealed before it touches the file, bound to its row, access-controlled down to a single node, chained into an audit log anyone can verify without a key — and searchable without being read. It has no idea what it stores. Written in Rust by Clavitor LLC. Governed by Swiss law.

Contra Dam · Val Verzasca · arch dam · 220 m · 1965

It does not know what it holds. Credentials, patient records, contracts, telemetry, ciphertext you encrypted yourself — same file, same guarantees. The engine's entire knowledge of a record is six plaintext facts about shape and lifecycle, plus which fields you told it to index.

vaultdb 1.3.1 · format 1
144 tests · frozen conformance vectors
AES-256-GCM · AES-KW · HKDF-SHA256 · zstd
FIPS 140-3 at rest · default build links AWS-LC-FIPS 2.0 · CMVP #4816 / #4759
nine-model security audit · 2026-07-28
What the file knows about a recordentries · 1 row
entry_id3f9a1c2b7e4d5a60
version3
typecredential
parent_id1b2c3d4e5f607182
statusactive
created_at1755388800000
blob 9c1e0b7a2f5d4c31 e08a3d5f6b2c9d41 7ab30cf5e2d9146b 58f2a1c47e0d93b6 c4d1e8ff2a67b09e 3b9f0e5a71c2d84f a2c6e0f19b3d5c78 6d4a8b2e0f7c1935 e7b0c3d94a1f6e28 0f5c2a7d9e3b4816 4d8e1a6c3f9b027e b1f7c0d5e2a4986c 73a9d2e5f0c1b48d …
checksum 015b54779d2fb2102324c916195ab3feae9a980c25b0a40b82fb019d68b534cd
Shape and lifecycle are plaintext. Content never is — and every seal is bound to exactly these six facts. That is the posture auditors ask about first: the store cannot read what it stores.

Built for the controls the frameworks ask for.

Encryption at rest per record, tamper-evident audit of every write and every export read, least-privilege access as a data structure, erasure that survives an audit — the engine gives you the mechanisms; your attestation gets shorter because there is less that could see the data.

SOC 2encryption, access, audit trail, change control
HIPAAPHI at rest, access logs, minimum necessary
ISO 27001A.8 cryptography, A.5 access, logging
GDPRArt. 32 security, Art. 17 erasure by crypto-shred
FADPSwiss data protection, applies regardless of residence
PCI DSSReq. 3 stored data, Req. 10 audit trails

These are the controls VaultDB gives you the mechanism for — encryption at rest, tamper-evident audit, least-privilege access, provable erasure. They are not certifications VaultDB holds: a certificate is a property of your deployment and your audit, not of a library. VaultDB is a component you build that case on.

And because the engine indexes only what you declare and seals the rest unread, data you encrypted client-side rides through untouched — encrypt before you store, and it still indexes, audits and shreds.

Nothing is overwritten.

Every write is a new sealed row. The highest version is current; nothing beneath it is ever touched.

Nothing disappears.

Deletion is a status, recursive through the tree. Grants and revokes are rows. History stays intact and verifiable.

Nothing is understood.

The engine reads only the fields you declared for indexing. Everything else — including ciphertext of your own — is sealed cargo.

Erasure destroys the key.

Crypto-shred destroys a record's key and its index residue. Rows and chain stay verifiable; the content is gone for good — GDPR and HIPAA erasure without rewriting history.

Downstream face of the Contra dam, concrete texture
Bound at rest

Every seal is cut to its row.

3f9a1c2b7e4d5a60|3|credential|1b2c3d4e5f607182|active|1755388800000
entry_idversiontypeparent_idstatuscreated_at— the associated data of the AES-256-GCM seal
How a record is built →
Contra Dam · downstream face
Prefix search over ciphertext

Others search because they can read. VaultDB searches what it cannot read.

A conventional database can search everything for one reason: it holds the plaintext. Encrypt at the field and search dies; encrypt the disk and everyone with database access still reads it all. VaultDB keeps a blind index — a two-byte bucket per indexed value, nothing else — and finds records by prefix without ever decrypting what it stores.

Try it, and see the bucket map →
The Allée des Nations, flags leading to the Palais des Nations, Geneva
Access control is the engine

One file. Many sovereigns.

Tenants share one file the way states share one hall: present, adjacent, and unable to read each other. Everything is a node; a grant on a node covers its whole subtree; one arbiter decides every operation, and what you cannot open you cannot see exists.

Access control, in full →
Allée des Nations · Palais des Nations · Geneva · 1936
The through-line

Sealed, scoped, and on the record.

Encryption binds each record to its row. Access decides who may open it. And the log remembers every open — proving, without a key, that the record of it was never altered. Three mechanisms, one file, one transaction each.

The stone arches of the Landwasser viaduct
The audit chain

History that cannot be rewritten. Not quietly, not at all.

Every write — and every export read — appends an audit row hashed over the one before it, sealed, and verifiable with no key. Edit, remove or reorder a row and the walk names the seq where it broke; roll back the whole file and the witness says so.

Verify at three levels →
Landwasser Viaduct · Albula line · 1902 · 65 m high · 136 m
Every guarantee has an edge

What it does not protect.

Published so you decide against facts, not against the sentence at the top of this page: what a file holder can still infer, what crypto-shred cannot reach outside the file, why truncation needs a witness, and why key rotation is not compromise recovery.

Threat model and edges →
Stone arcades on Börsenstrasse, Zürich
Jurisdiction

Governed by Swiss law, from Zürich.

Licensing and contact →
Börsenstrasse · Zürich · 1922
144
tests, including raw-SQL tamper attacks, cross-tenant isolation, and shred-residue sweeps of the whole directory
1format
at-rest contract, frozen in conformance vectors — a vector failure is a breaking format change, not a test to regenerate
9models
independent security audit, July 2026: every Critical and High closed with a regression test each; the rest published as edges
140-3
FIPS 140-3 at rest — the default build compiles and links every cryptographic primitive against the validated AWS-LC-FIPS 2.0 module, CMVP #4816 static / #4759 dynamic, Linux x86_64 and aarch64