Documentation

Security

How Simpl protects your database connections and data.

Overview

Security is fundamental to Simpl. We've designed the system with multiple layers of protection to keep your database credentials and data safe.

Connection Security

Credential Encryption

Your database connection strings are encrypted at rest using industry-standard encryption:

AspectImplementation
AlgorithmAES-256-GCM
Key Size256 bits
IVUnique per connection
AuthenticationGCM authenticated encryption

This means your credentials are:

  • Encrypted before being stored
  • Decrypted only when establishing connections
  • Protected even if our database were compromised

Connection Testing

Before saving a connection, Simpl tests it to verify:

  • Network connectivity
  • Authentication credentials
  • Database accessibility

This happens in a secure, isolated context without storing credentials until confirmed.

Query Security

SQL Injection Prevention

Simpl uses multiple layers to prevent SQL injection:

  1. Identifier allow-listing - Table and column names are validated against the cached schema
  2. PostgreSQL identifier quoting - All identifiers use proper quoting ("schema"."table")
  3. Parameterized queries - All user values are passed as parameters, never concatenated

Example

When you filter for name = "John":

-- What Simpl executes (safe)
SELECT * FROM "users" WHERE "name" = $1
-- Parameters: ['John']

-- NOT this (unsafe)
SELECT * FROM users WHERE name = 'John'

Query Timeouts

All queries have a 10-second timeout to prevent:

  • Runaway queries from affecting database performance
  • Denial-of-service through complex queries
  • Connection pool exhaustion

Access Control

Database Credentials

Simpl connects using the credentials you provide. Access is limited by:

  • Your database user's privileges
  • PostgreSQL's built-in access control
  • Your database's network policies

Recommendation

Create a dedicated database user for Simpl with:

-- Example: Read-only access
CREATE USER simpl_readonly WITH PASSWORD 'secure_password';
GRANT CONNECT ON DATABASE mydb TO simpl_readonly;
GRANT USAGE ON SCHEMA public TO simpl_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO simpl_readonly;

For editing capability:

-- Example: Read-write access
CREATE USER simpl_readwrite WITH PASSWORD 'secure_password';
GRANT CONNECT ON DATABASE mydb TO simpl_readwrite;
GRANT USAGE ON SCHEMA public TO simpl_readwrite;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO simpl_readwrite;

User Isolation

Each Simpl user can only access:

  • Connections they've created
  • Data accessible through those connections
  • Their own layout configurations

Data Handling

What We Store

Simpl stores:

DataPurposeProtection
Connection stringsDatabase accessAES-256 encrypted
Schema cachePerformanceRefreshed hourly
Layout configsUser preferencesPer-user isolation
User accountsAuthenticationManaged by auth provider

What We Don't Store

Simpl does NOT store:

  • Your actual database data (we query on demand)
  • Query results (fetched and displayed, not cached)
  • Audit logs of your changes (use database-level auditing)

Data in Transit

All communication is encrypted:

  • HTTPS for all web traffic
  • TLS for database connections (when supported)
  • No data sent to third parties

Network Security

Database Connection

For maximum security, consider:

  1. SSL/TLS connections - Add ?sslmode=require to your connection string
  2. IP allowlisting - Restrict database access to known IPs
  3. VPN/Private networks - Use private database endpoints

SSL Connection Example

postgresql://user:pass@host:5432/db?sslmode=require

SSL modes:

ModeDescription
requireEncrypt connection, don't verify certificate
verify-caVerify server certificate is signed by trusted CA
verify-fullVerify certificate and hostname

Infrastructure Security

Hosting

Simpl is hosted on secure, modern infrastructure:

  • Regular security updates
  • Network isolation
  • Monitoring and alerting

Encryption at Rest

All data stored by Simpl is encrypted at rest:

  • Database encryption
  • Backup encryption
  • File storage encryption

Best Practices

For Connection Credentials

  1. Use dedicated users - Don't use superuser/admin accounts
  2. Limit privileges - Grant only necessary permissions
  3. Rotate passwords - Update credentials periodically
  4. Use SSL - Enable encrypted connections

For Database Configuration

  1. Enable SSL - Require encrypted connections
  2. Allowlist IPs - Restrict network access
  3. Audit logging - Enable PostgreSQL logging
  4. Regular backups - Maintain backup strategy

For Your Team

  1. Individual accounts - Don't share Simpl logins
  2. Review access - Audit who has database connections
  3. Remove stale connections - Delete unused connections

Compliance

Data Privacy

Simpl is designed with privacy in mind:

  • We don't access your database data except to serve your requests
  • We don't share connection information with third parties
  • We don't analyze or mine your database contents

Data Residency

Consider your data residency requirements:

  • Simpl servers are located in [region]
  • Database queries traverse the network to your database location
  • Schema metadata is cached on our servers

Incident Response

If You Suspect a Breach

  1. Rotate credentials - Change your database password immediately
  2. Remove connection - Delete the connection from Simpl
  3. Audit access - Check your database logs
  4. Contact us - Reach out at security@simpl.sh

Reporting Security Issues

If you discover a security vulnerability:

  • Email: security@simpl.sh
  • Include details of the vulnerability
  • Allow reasonable time for response before disclosure

Questions

For security-related questions:

Next Steps