TCP proxyEnterprise

Enterprise and regulated: the proxy in your VPC and the evidence for your auditor

In a bank, an insurer or a healthcare company, the SQL that reaches production has to be controlled and, on top of that, provable. On Enterprise, the Vericto proxy runs in your VPC and your team runs it: it evaluates inside your network and your credentials never leave it. The control plane is shared on Standard, or dedicated in the region you choose and connected over AWS PrivateLink on Enhanced and Premium. Every decision goes into a signed audit trail your auditor can verify.

Talk to sales What Enterprise includes
Diagram: Enterprise deployment with the Vericto proxy in your VPCIn your AWS account, inside your VPC, your applications connect to the Vericto proxy, which your team runs and which evaluates every statement before PostgreSQL or MySQL; a blocked statement returns to the application as an error. The proxy syncs the rules and sends telemetry to the Vericto control plane, shared on Standard or dedicated on Enhanced and Premium, over HTTPS with TLS or AWS PrivateLink. Your identity provider gives access to the dashboard with SSO over OIDC.Your AWS account: your VPCVericto control planeHTTPS/TLS or PrivateLinkSSO (OIDC)Your applicationsVericto proxyrun by your teamEvaluates hereDatabasePostgreSQL or MySQLVericto Cloudshared or dedicatedYour IdPOkta · Entra IDDiagram: Enterprise deployment with the Vericto proxy in your VPCIn your AWS account, inside your VPC, your applications connect to the Vericto proxy, which your team runs and which evaluates every statement before PostgreSQL or MySQL; a blocked statement returns to the application as an error. The proxy syncs the rules and sends telemetry to the Vericto control plane, shared on Standard or dedicated on Enhanced and Premium, over HTTPS with TLS or AWS PrivateLink. Your identity provider gives access to the dashboard with SSO over OIDC.Your AWS account: your VPCVericto control planeSSO (OIDC)Your applicationsVericto proxyrun by your teamEvaluates hereDatabasePostgreSQL or MySQLVericto Cloudshared or dedicatedYour IdPOkta · Entra ID
  • SQL statement path
  • Vericto Cloud: rules and telemetry
  • Blocked statement: an error comes back
  • Where Vericto evaluates
On the left, your AWS account: your applications, the Vericto proxy and your database, all in your VPC. On the right, the control plane: shared on Standard, or dedicated, in an AWS account just for you, on Enhanced and Premium. Only rule sync and telemetry cross, over HTTPS with TLS or, on a dedicated deployment, over AWS PrivateLink. Your team signs in to the dashboard with SSO from your IdP.

What it protects

The same rules as in any other architecture, with the proxy inside your network, plus the controls a security team or a regulator asks for:

  • Append-only audit trail: every decision is recorded, with the query text encrypted with AES-256-GCM. The database rejects edits and deletions of events; only your plan's retention purge removes them.
  • Monthly compliance report: on the 1st of each month, a PDF signed with Ed25519 with the evidence for 6 SOC 2 criteria and 6 ISO/IEC 27001:2022 controls, kept 13 months or what your contract sets. CSV and JSON exports are signed too, and your auditor verifies the signature with Vericto's public key.
  • SSO with OIDC (Okta, Microsoft Entra ID and Google Workspace), which you can make mandatory for your whole domain, four roles and a log of every administrative change, with the actor, the IP and the before and after.
  • Retention set by your contract: one year of query history included, extendable to 3 or 7 years as an add-on.
  • VERICTO-087 and VERICTO-085: allowlists per agent or service, and sensitive columns blocked or masked, included in Enterprise.

On scope: Vericto produces evidence for those controls; it does not replace an audit, nor does it mean Vericto is certified. Vericto's own SOC 2 is in progress and Vericto is not ISO 27001 certified. If your procurement process needs more information, write to security@vericto.com.

Latency and availability

The proxy sits in your VPC, next to the application, and evaluates in its own process. Rule sync and telemetry stay off the critical path: over HTTPS with TLS on Standard, and over AWS PrivateLink, without crossing the internet, on Enhanced and Premium.

For parsing and rule evaluation, the design target is p99 < 2 ms. It is a target, not a measurement: the proxy latency benchmark is not published yet.

Three SLA tiers, with service credits: Standard, 99.9% on shared infrastructure; Enhanced, 99.95% on a dedicated single-region deployment; Premium, 99.99% on a dedicated multi-region active-active deployment. On Enhanced and Premium, the SLA runs from deployment acceptance. Each tier comes with its support level, from a 1 h first response to a P1 on Standard to 15 min on Premium: support tiers.

Data residency: on Enhanced and Premium, the whole control plane runs in your dedicated AWS account and in the regions you choose. Standard runs in AWS us-east-1 and does not guarantee data residency.

How to implement it

  1. Talk to sales and choose the tier (Standard, Enhanced or Premium), the region and the retention: the Order Form sets them. On Enhanced and Premium, the contract's deployment annex lists every component and where it runs.
  2. On Enhanced and Premium, we build the dedicated deployment for your start date and verify it with you before go-live.
  3. Deploy the proxy in your VPC: the container ghcr.io/vericto/vericto-proxy on ECS or Kubernetes, in private subnets next to the application, with several replicas behind an internal load balancer. During onboarding we guide you through the rollout and the rule tuning.
  4. Connect the proxy to the control plane: over AWS PrivateLink on Enhanced and Premium, over HTTPS with TLS on Standard. If the query text must not leave your network as is, use sanitized telemetry.
  5. Set up SSO and make it mandatory for your domain, assign the roles and give your auditor the read-only Viewer role.
  6. Start in observe mode, simulate every change against your real traffic (per contract, up to 180 days) and enforce the rules. The first monthly report arrives on the 1st of the following month.

When not to use this option

  • You need Vericto's own SOC 2 report as a vendor today. It is in progress and does not exist yet: Vericto gives you evidence for your controls, not its own certification.
  • Guaranteed data residency on shared infrastructure. Standard does not guarantee it: that is what Enhanced and Premium are for.
  • Nobody can run the proxy. Its availability is your team's responsibility. If you cannot take that on, the Runtime API evaluates without a component in your network, at the cost of one call per statement and of your code honouring the decision.
  • Snowflake through a proxy in your VPC. Snowflake has no proxy: it is evaluated with the Runtime API, the Validation API, the CLI and MCP. See data warehouse.

Plan availability

FeatureFreeBuilderTeamEnterprise
TCP proxy, Runtime API, CLI and MCPYesYesYesYes
Query history7 days30 days90 daysPer contract
Signed audit-trail export (CSV/JSON and PDF)——YesYes
Automatic monthly compliance report———Yes
SSO (OIDC)———Yes
VPC deployment———Yes
Dedicated deployment in your region———Enhanced and Premium
API uptime SLA—99.5%99.9%99.9%; 99.95% and 99.99% with a dedicated deployment

Prices and every limit on Pricing.

Let's talk about your deployment

Tell us about your stack, your region and your audit requirements, and we will prepare a proposal with the deployment, retention and SLA you need. Enterprise Standard starts at USD 2,500 a month, on an annual contract.

Talk to sales Start free