SOLUTIONS

One deterministic check on every query, for every team that writes one

AI agents, CI pipelines and people send SQL to the same databases. Vericto evaluates every statement on its AST before it runs, and each team uses it from where it already works: the proxy, the CLI, the API or MCP.

Start freeTalk to sales

By use case

AI agents and text-to-SQL

An LLM with database access can generate a DELETE without WHERE. Vericto blocks it and returns the error and the suggested fix to the agent.

CI/CD and migrations

The CLI evaluates your migration files against the workspace rules and fails the pipeline with exit code 1 if a statement is blocked.

Personal data (PII)

Tag sensitive columns and decide whether a query that reads them is blocked, flagged or gets the masked value back, on Postgres and MySQL.

Evidence for SOC 2 and ISO 27001

The exported, signed audit trail, mapped to specific controls. It is evidence for your auditor, not a Vericto certification.

Coding agents with MCP

check_sql checks migrations and queries while the agent writes them, before a commit exists.

Platform engineering

One control layer in front of the databases your applications, agents and pipelines use, without changing their code.

  • The TCP proxy speaks the PostgreSQL and MySQL protocols and runs in your infrastructure: your connection string never leaves it.
  • For Oracle and SQL Server, the HTTP API and the CLI evaluate the same rules; there is no protocol proxy for those dialects.
  • Observe mode: for 7 days Vericto blocks nothing and shows what it would have blocked, so you can measure the impact before enforcing the rules.

DBAs

Rules that work on each statement's syntax tree, with PostgreSQL's official parser (libpg_query) and sqlparser-rs for MySQL, Oracle and SQL Server.

  • The critical rules (DELETE and UPDATE without WHERE, DROP, TRUNCATE and COPY … PROGRAM) block by default in every workspace.
  • Severity and action are separate: you decide whether a rule blocks, flags or only logs, without changing its severity.
  • The simulator tests a rule change against the workspace's real traffic before you apply it.

Security and compliance

Policies applied before the query runs, and a record you can hand to an auditor.

  • Per-column masking and an allowlist of tables and columns per agent.
  • Every decision goes into the audit trail. Exports and the compliance report are signed with Ed25519 and can be verified.
  • Administrative change log: API keys, members and roles, SSO, enforcement policy and sensitive columns, with the actor and the IP.

AI engineers

Your agent needs SQL to be useful. It does not need to be able to run a DROP TABLE.

  • When a statement is blocked, the agent gets an SQL error with the rule and the suggested fix, and can retry.
  • An allowlist per agent limits the tables and columns each one can use; everything else is denied.
  • With MCP, the coding agent checks the SQL with check_sql while it writes it.

Regulated industries

Vericto does not hold certifications of its own yet: it is in the process of SOC 2 and has neither a SOC 2 report nor ISO 27001 certification. What it does offer teams in regulated industries today:

  • A public DPA, with the Standard Contractual Clauses for the GDPR, the UK Addendum, the ANPD clauses for the LGPD, and Colombia's Ley 1581.
  • On Enterprise Enhanced and Premium, a dedicated deployment in the AWS region you choose, with data residency in that region.
  • Evidence mapped to SOC 2 and ISO/IEC 27001:2022 controls for your organization's audit.

Try it on your own SQL

The Free plan includes 500K queries a month and 1,000 CLI and MCP checks, with no credit card.

Start free