Immutable by construction.
VaultDB is an encrypted database engine: every record sealed before it touches the file, bound to its row, access-controlled down to a single node, chained into an audit log anyone can verify without a key — and searchable without being read. It has no idea what it stores. Written in Rust by Clavitor LLC. Governed by Swiss law.
It does not know what it holds. Credentials, patient records, contracts, telemetry, ciphertext you encrypted yourself — same file, same guarantees. The engine's entire knowledge of a record is six plaintext facts about shape and lifecycle, plus which fields you told it to index.
144 tests · frozen conformance vectors
AES-256-GCM · AES-KW · HKDF-SHA256 · zstd
FIPS 140-3 at rest · default build links AWS-LC-FIPS 2.0 · CMVP #4816 / #4759
nine-model security audit · 2026-07-28
checksum 015b54779d2fb2102324c916195ab3feae9a980c25b0a40b82fb019d68b534cd
Built for the controls the frameworks ask for.
Encryption at rest per record, tamper-evident audit of every write and every export read, least-privilege access as a data structure, erasure that survives an audit — the engine gives you the mechanisms; your attestation gets shorter because there is less that could see the data.
These are the controls VaultDB gives you the mechanism for — encryption at rest, tamper-evident audit, least-privilege access, provable erasure. They are not certifications VaultDB holds: a certificate is a property of your deployment and your audit, not of a library. VaultDB is a component you build that case on.
And because the engine indexes only what you declare and seals the rest unread, data you encrypted client-side rides through untouched — encrypt before you store, and it still indexes, audits and shreds.
Every write is a new sealed row. The highest version is current; nothing beneath it is ever touched.
Deletion is a status, recursive through the tree. Grants and revokes are rows. History stays intact and verifiable.
The engine reads only the fields you declared for indexing. Everything else — including ciphertext of your own — is sealed cargo.
Crypto-shred destroys a record's key and its index residue. Rows and chain stay verifiable; the content is gone for good — GDPR and HIPAA erasure without rewriting history.
Every seal is cut to its row.
Others search because they can read. VaultDB searches what it cannot read.
A conventional database can search everything for one reason: it holds the plaintext. Encrypt at the field and search dies; encrypt the disk and everyone with database access still reads it all. VaultDB keeps a blind index — a two-byte bucket per indexed value, nothing else — and finds records by prefix without ever decrypting what it stores.
Try it, and see the bucket map →
One file. Many sovereigns.
Tenants share one file the way states share one hall: present, adjacent, and unable to read each other. Everything is a node; a grant on a node covers its whole subtree; one arbiter decides every operation, and what you cannot open you cannot see exists.
Access control, in full →Sealed, scoped, and on the record.
Encryption binds each record to its row. Access decides who may open it. And the log remembers every open — proving, without a key, that the record of it was never altered. Three mechanisms, one file, one transaction each.
History that cannot be rewritten. Not quietly, not at all.
Every write — and every export read — appends an audit row hashed over the one before it, sealed, and verifiable with no key. Edit, remove or reorder a row and the walk names the seq where it broke; roll back the whole file and the witness says so.
Verify at three levels →What it does not protect.
Published so you decide against facts, not against the sentence at the top of this page: what a file holder can still infer, what crypto-shred cannot reach outside the file, why truncation needs a witness, and why key rotation is not compromise recovery.
Threat model and edges →
Governed by Swiss law, from Zürich.
VaultDB is a product of Clavitor LLC. These terms are governed by the laws of Switzerland; disputes are resolved in the courts of Zürich. Switzerland's Federal Act on Data Protection applies regardless of where you live; Swiss law does not permit bulk surveillance or warrantless access, and foreign governments cannot compel disclosure without Swiss legal process.
Licensing and contact →