How Vault Mode Works: Client-Side Encryption for Database Credentials

Trust is the hardest part of adopting a cloud-based SQL client. “You want me to put my production database credentials in your cloud? No way.”

We agree. You shouldn’t trust us with your raw credentials. That is why we built Vault Mode.

The “Zero-Knowledge” Architecture

Vault Mode ensures that VaultSQL (the vendor) cannot access your database, even if we wanted to. Even if we were subpoenaed. Even if our database was leaked.

How It Works (Step-by-Step)

1. The Vault Key: When you create a workspace, you generate a Vault Key (a strong passphrase). This key is never sent to our servers. It lives only in your browser’s local storage (or memory).

2. Encryption: When you add a database credential (e.g., a password), it is encrypted client-side in your browser using your Vault Key. We only receive the encrypted blob (ciphertext). We store this blob in our database.

3. Decryption: When you run a query:

   • Option A (Local Proxy/Agent): The encrypted blob is sent to your local machine (or a private agent in your VPC). Your local agent decrypts it using the key you provide and connects to the DB directly.
   • Option B (Browser Decryption): The blob is decrypted in the browser memory to establish a secure WebSocket connection (if supported).

The Trade-Off: No Password Resets

Because we don’t have your Vault Key, we cannot reset it for you. If you lose your Vault Key, you lose access to the stored credentials. You will have to re-enter them. This is a feature, not a bug. It proves that we truly do not have a “backdoor” to your data.

Why This Matters

• Vendor Risk Mitigation: If VaultSQL gets hacked, the attackers get useless encrypted blobs.
• Compliance: For highly regulated industries (FinTech, HealthTech), this architecture satisfies strict data sovereignty requirements.
• Peace of Mind: You get the UX of a SaaS tool with the security profile of a self-hosted tool.

Conclusion

Vault Mode bridges the gap between convenience and security. It allows you to use a modern, collaborative tool without violating the cardinal rule of security: Never share your secrets.