Reference architectures
Where Vericto sits in your stack, which mode to use, what it protects, what it costs in latency and how to start. One page per architecture, with its diagram, its failure behaviour and what each plan includes.
Web application
The TCP proxy between the connection pool and Postgres or MySQL, without changing your code.
See the architecture → TCP proxyMicroservices and Kubernetes
The proxy as a shared service per database or as a sidecar in each pod.
See the architecture → TCP proxyRuntime APIMCPSDK (coming soon)AI agents and text-to-SQL
Per-agent allowlists and masking at the proxy, the Runtime API and MCP.
See the architecture → Runtime APICLISDK (coming soon)Partly coming soonData warehouse and analytics
Snowflake with no proxy: the Runtime API before execution, today, and the SDK in the driver, coming soon.
See the architecture → CLITCP proxySDK (coming soon)Partly coming soonData pipelines
dbt checked in CI before deploy, and every Airflow SQL task, through the proxy.
See the architecture → CLIGitHub ActionMCPCI/CD and migrations
Every migration and .sql file checked in the pull request, with the CLI or the GitHub Action.
See the architecture → Runtime APIServerless and edge
One Runtime API call before each query, from AWS Lambda or Cloudflare Workers.
See the architecture → TCP proxyMulti-tenant SaaS
Rules and allowlists per database and per service user, with one proxy per database or tenant group.
See the architecture → TCP proxyEnterpriseEnterprise and regulated
The proxy in your VPC, a signed audit trail, a monthly compliance report, SSO and an SLA of up to 99.99%.
See the architecture →The modes, at a glance
They all evaluate with the same engine and your workspace's rules. They combine: most teams use the proxy at runtime and the CLI in CI.
| Mode | Where it evaluates | What happens to a blocked statement |
|---|---|---|
| TCP proxy | In your infrastructure, between the application and PostgreSQL or MySQL | It never reaches the database: the driver gets an error |
| Runtime API | In Vericto Cloud, before your code runs it | Your code does not run it (a 403 answer) |
| CLI and GitHub Action | In Vericto Cloud, from your CI pipeline | The job fails; nothing runs |
| MCP | In Vericto Cloud, while your coding agent writes | The agent gets the verdict and the fix |
| Python and Node SDKs (coming soon) | In your code, through the Runtime API | Coming soon |
Your architecture is not here?
Tell us about your stack and we will tell you where Vericto goes. Or start free with the proxy, the API, the CLI or MCP.