rmBug provides an identity‑centric access layer for PostgreSQL, MySQL, and MariaDB that authenticates users via corporate SSO or API keys and enforces just‑in‑time, time‑bounded permissions. A cross‑platform CLI proxy forwards traffic to a VPC‑hosted gateway, logs every query in tamper‑evident, encrypted audit logs, and supports row‑level policies, query firewalls, and compliance reporting.
Funding
Funding not disclosed
Founders
Product
Problem
Organizations that rely on PostgreSQL, MySQL, or MariaDB often grant shared credentials, use VPNs or bastion hosts, and lack granular, time‑bound access controls. This makes it difficult to enforce least‑privilege policies, audit individual queries, and meet compliance standards such as SOC 2, HIPAA, or ISO 27001.
Solution
rmBug inserts an identity‑centric access layer between users (or automated workloads) and their databases. Engineers authenticate via corporate SSO, while AI agents, CI/CD pipelines, and other scripts use dedicated API keys, each with its own role‑based policy. Access grants are time‑limited by default and can be approved manually, automatically, or set as always‑on for trusted groups. A lightweight cross‑platform CLI agent handles authentication and forwards traffic to a VPC‑deployed gateway, eliminating the need for VPN tunnels or firewall changes. Every connection and SQL statement is captured, encrypted, and stored in tamper‑evident logs that support PII redaction and query‑firewall rules. The control plane provides a unified policy engine, audit dashboard, and approval workflow, enabling continuous compliance without disrupting existing database client workflows.
Target Audience
Primary customers are engineering and DevOps teams that need secure, auditable database access, as well as security and compliance officers in mid‑size to large enterprises deploying AI/ML pipelines and CI/CD automation.
Features
- Cross‑platform CLI agent with native SSO integration and API‑key support for machine identities
- Just‑in‑time, time‑bounded access grants with configurable approval workflows (manual, automatic, always‑on)
- Transparent local proxy that preserves full client functionality (prepared statements, COPY, LISTEN/NOTIFY, etc.) for psql, mysql CLI, TablePlus, DBeaver, DataGrip, etc.
- VPC‑resident gateway that injects dynamic or static credentials from secret managers (AWS Secrets Manager, HashiCorp Vault) and never exposes passwords to end users
- Policy engine with row‑level access controls, query firewall, and configurable PII redaction applied to audit logs
- End‑to‑end TLS encryption and at‑rest credential encryption, with tamper‑evident, searchable audit logs accessible via a web dashboard or API
- Built‑in compliance reporting aligned with SOC 2, HIPAA, SOX, and ISO 27001 requirements