Matomo

Acra – data security solution

🇺🇦 We stand with Ukraine, and we stand for Ukraine. We offer free assessment and mitigation services to improve Ukrainian companies security resilience.

Cossack Labs
search
Acra — data security solutionfor databases and distributed apps

Acra

Acra — data security solution
for databases and distributed apps

Acra provides fast field level encryption, searchable encryption, data tokenization and data masking, and many more. Acra protects sensitive data in SQL and NoSQL databases, web and backend applications.

Easy integration, low impact, works with your stack.

Product sheet
What is Acra Usage scenarios Adressed risks Security controls How to evaluate Pricing

Acra scales and adapts with sensitive data flow

Acra blends well with your application as SQL encryption proxy (AcraServer), encryption-as-a-service API (AcraTranslator), proxy service for any API (AnyProxy), or in-app SDKs. Wherever your data is, Acra is designed to be nearby, enforcing appropriate security controls on your sensitive assets.

  • tab 0 icon 1 tab 0 icon 2
    Transparent database encryption for SQL

    Transparent database encryption for SQL

    SQL Proxy (AcraServer) sits before SQL database and encrypts / decrypts data. This design allows Acra to provide visibility to all sensitive data operations and enforce appropriate security controls.

    Orchestrated suite of security controls

    Orchestrated suite of security controls

    Encryption, searchable encryption, data masking, tokenization, request authZ, component authN enforcement, SQL firewall, data leakage detection, audit logging service, and security events automation in one suite.

    The least intrusive integration

    The least intrusive integration

    AcraServer is the best for introducing all Acra’s security functions into architecture in the least intrusive way. Requires certain design decisions for efficient scaling.

  • tab 1 icon 1 tab 1 icon 2
    Application level encryption as API

    Application level encryption as API

    API Service (AcraTranslator) exposes relevant Acra’s features as REST / gRPC API. Integrate API service into the same infrastructure / cloud, or move it into a protected environment. Client-side apps don’t have access to the cryptographic keys.

    Security controls at API request distance

    Security controls at API request distance

    Encryption, searchable encryption, tokenization, audit logging service and security events automation at one API call distance.

    Easy to scale

    Easy to scale

    AcraTranslator is the best for running encryption/decryption at scale in stateless architectures. Requires simple application modification.

  • tab 2 icon 1 tab 2 icon 2
    Client-side encryption & decryption

    Client-side encryption & decryption

    Two client-side SDKs for encryption and decryption inside the application. Combine SDKs with SQL Proxy and API service to compartmentalize the data flow.

    Build end-to-end encryption data flows

    Build end-to-end encryption data flows

    How to build end-to-end encryption? Encrypt sensitive data locally, transmit securely to the trusted environment, decrypt locally. Combine SDKs with SQL Proxy and API service to build "partially" encrypted data flows.

    Collect data encrypted

    Collect data encrypted

    Acra client-side SDKs are the best for collecting sensitive data outside the controlled perimeter and then transmitting it. They help to manage load and architecture complexity efficiently.

  • tab 3 icon 1 tab 3 icon 2
    Protect any datastore

    Protect any datastore

    AnyProxy is an embedded SDK and API service: the client-side SDK connects to a standalone API service to perform encryption/decryption and execute policies.

    Orchestrated suite of security controls

    Orchestrated suite of security controls

    All Acra data security features, orchestrated by control plane with policy, configuration and key management.

    Centralised security policy

    Centralised security policy

    AnyProxy is the best for large heterogeneous infrastructures with multiple datastores.

We help the leaders to build secure systems at scale

appspector baja-bikes bear-app ciklum datasite epam ethicontrol input-out goclinic kit macpaw merrill muse anthill nec uptech userbase treeum xrpl-labs tezos-foundation madfish-solutions mygaru clearful hiveon xaman temple wallet unqork allbridge crossmint paella.dev paysafe tradingcom Twist Robotics

Main usage scenarios #

Acra can be used in many ways, yet there are several main distinct security challenges our customers and open-source adopters choose Acra for.

Application level encryption

Application level encryption

Acra enables field level encryption on application layer as a database proxy (PostgreSQL / MySQL wire protocol), as an API service or a client-side SDK. Choose what fits your use case best.

Sensitive data vault

Sensitive data vault

Acra is equipped with tools to detect data leaks, unauthorised access, and abnormal access patterns using techniques like request analysis, honey tokens, verifiable audit logs, etc.

Database encryption

Database encryption

Acra SQL Proxy acts like a regular SQL database, while running all the necessary security operations under the hood. Data encryption is transparent for the application.

Build security solutions that meet your unique needs

Proven across industries and apps

  • Fintech, banking, and neobanks
  • Transaction processing systems
  • Critical infrastructure / CNI
  • SaaS platforms
  • Documents exchange (VDR)
  • Healthcare records exchange (EHR)
  • Industry enterprises, SCADA / ICS
  • IIoT / IoT
  • Any apps that operate on sensitive or personal data

Solve many challenges with one flexible solution

  • Low-footprint security upgrade
  • Address many data security risks together
  • Usable protected data
  • Data security in multiple environments
  • Data security in the cloud
  • Address privacy requirements

Achieve full regulatory compliance

  • GDPR, LGPD
  • DPA encryption requirements
  • PCI DSS
  • DPB
  • PSD2
  • CCPA, CPRA
  • FISMA
  • HIPAA / HITECH Act
  • FFIEC
  • And others
Acra on G2 Acra on G2 Acra on Capterra Acra on Capterra

See Acra GitHub for more docs and examples.

Available for:

iOS Android Linux
MySQL PostgreSQL MongoDB
Python Go PHP Ruby Node.js C++
See Acra's availability

More than data at rest encryption, more than TLS #

Role-based access
control (RBAC)

Database privilege abuse
  • • Violation of least-privilege (POLP)
  • • Stolen credentials

Data access restricted based on user role. Effective when configured properly and credentials are stored securely.

Network snooping, MitM
  • • Packet sniffing
  • • IP / DNS spoofing

Not addressed by this security feature

Data theft
  • • Physical access to database host
  • • Database file exposed

Not addressed by this security feature

Access to database
  • • Memory dump analysis / scraping
  • • Privileged access to database host

Not addressed by this security feature

TLS encryption

Database privilege abuse
  • • Violation of least-privilege (POLP)
  • • Stolen credentials

Not addressed by this security feature

Network snooping, MitM
  • • Packet sniffing
  • • IP / DNS spoofing

Data is encrypted for transport over a trusted network connection. Effective when TLS best practices are followed.

Data theft
  • • Physical access to database host
  • • Database file exposed

Not addressed by this security feature

Access to database
  • • Memory dump analysis / scraping
  • • Privileged access to database host

Not addressed by this security feature

FS / DB at rest
encryption or TDE

Database privilege abuse
  • • Violation of least-privilege (POLP)
  • • Stolen credentials

Not addressed by this security feature

Network snooping, MitM
  • • Packet sniffing
  • • IP / DNS spoofing

Not addressed by this security feature

Data theft
  • • Physical access to database host
  • • Database file exposed

Encrypted data on disk remains encrypted unless an attacker has access to the encryption key(s).

Access to database
  • • Memory dump analysis / scraping
  • • Privileged access to database host

In some cases if configured correctly

Acra field
level encryption

Sensitive data is encrypted on a field level.


Data stays encrypted at all times on the database host and in network transit.


The database host doesn't have access to the decryption keys or ways to decrypt data.


Even in case of leakage, all data is encrypted.


Security responsibility is shifted to Acra and key storage.

Address concerns quickly

Wondering if Acra will solve your challenge? Let’s find out together!

Our team will provide you a detailed technical description, answer your questions, assist in optimising sensitive data flows, and help you in evaluating Acra.

Data security
building blocks

Plug various Acra components where necessary or use Acra’s proxies as choke points. Acra provides a unified set of data security controls you can use across your application whenever sensitive data needs protection.

  • Encryption

    Select from two encryption schemes to balance speed and security, use search over encrypted data, combine encryption with tokenization.

    Apply encryption: on SQL proxy, AnyProxy via API service or using in-app SDK.

    Read moreEncryption

    Tokenization

    Replace sensitive data with tokens while storing sensitive data encrypted. Make tokens format-preserving and visually look-alike the original data.

    Apply tokenization: on SQL proxy, AnyProxy or via API service.

    Read moreTokenization

    Request authorization & filtering

    Use built-in SQL firewall to filter forbidden SQL queries. Enforce granular access control policy on users and services originating the queries.

    Apply firewall: on SQL proxy.

    Read moreRequest authorization & filtering

    Masking

    Store data encrypted while masking and replacing data in database output. Configure mask format and plaintext length.

    Apply masking: on SQL proxy and AnyProxy.

    Read moreMasking

  • Poison records / honey tokens

    Acra puts poison records – special data blocks in database tables that look like regular encrypted records, but once they’re requested through Acra, it raises security alarm and halts decryption.

    Apply poison records: SQL proxy, API service and AnyProxy can detect and react on poison records.

    Read morePoison records / honey tokens

    Request filtering

    Configure built-in SQL firewall to log unknown/suspicious SQL queries into a separate file for futher analysis. Use this log to improve filtering configuration or detect suspicious behavior early on.

    Apply firewall: on SQL proxy.

    Read moreRequest filtering

    Logs, events

    Acra’s security log is specifically pre-configured to be helpful to SIEM/SOC operators in building analytics and automation around security events.

    Apply logging: on SQL proxy, API service, and AnyProxy.

    Read moreLogs, events

    Arbitrary patterns

    Acra can be used as conventional DLP for the database, making sure that chosen patterns or data blocks never pass Acra without an alarm.

    Apply DLP: on SQL proxy, AnyProxy and via API service (partial).

    Read moreArbitrary patterns

  • React on poison records

    Upon detecting poison records, either run a special script, or shutdown Acra completely to stop the incident.

    Apply poison records: SQL proxy, API service and AnyProxy can detect and react on poison records.

    Read moreReact on poison records

    Key revocation

    Run key rotation and revocation procedures and mark those keys as untrusted. Key rotation is possible with or without data re-encryption.

    Apply key rotation: run a separate utility on SQL proxy, API service and AnyProxy.

    Read moreKey revocation

    Send predefined responses

    Upon detecting malicious queries, send predefined responses instead of actual data. Zip bombs FTW.

    Apply predefined responses: on SQL proxy, API service, and AnyProxy.

    Read moreSend predefined responses

  • Verify audit logs

    Run verification utility to find out if anyone has tampered Acra's audit logs, or if services were suddenly restarted.

    Verify audit logs: run a separate utility to confirm a trusted Acra services execution.

    Read moreVerify audit logs

    Gather evidence

    Backup materials for forensic investigation: audit logs, Acra configuration, SQL firewall configuration, a list of suspicious queries.

    Backup materials: configuration and log files.

    Read moreGather evidence

  • Policy management

    Match IPs, users, sessions with database tables, encryption keys, and request filtering. Apply different policies based on keys, origin and other factors.

    Use policies: on SQL proxy, API service and AnyProxy.

    Read morePolicy management

    Policy GUI edition

    Design general policies and copy policies between nodes while adapting to data layout.

    Use policies: on SQL proxy, API service and AnyProxy.

    Read morePolicy GUI edition

  • In cloud or on prem

    Acra SQL proxy, AnyProxy, and API service run on CentOS, RHEL, Debian, Ubuntu, and support on prem or cloud databases. Deploy Acra to AWS, DO, GCP, other clouds or on prem.

    Digital Ocean Acra 1-Click App is available.

    Read moreIn cloud or on prem

    KMS integration

    Integrate key storage and key management procedures with Amazon KMS, Google Cloud KMS, Hashicorp Vault, Keywhiz, HSMs.

    Read moreKMS integration

    IaaC, load balancing, scaling

    Acra supports all major IaaC tools. Acra docs describe recommendations on horizontal and vertical scaling.

    Read moreIaaC, load balancing, scaling

    SIEM integration

    Acra’s security log is specifically pre-configured to be helpful to SIEM/SOC operators in building analytics and automation around security events.

    Read moreSIEM integration

  • Ingest

    Stand-alone SDK to enable data collection from remote devices with limited capability to encrypt and cache data.

    Parse

    Tooling to parse signals from/to popular ICS, SCADA and IIoT formats to provide seamless integration.

    Store

    Optimized encryption and storage model to protect huge amounts of tiny blocks of data (telesignals) efficiently, and support for TS datastores.

    Use

    Acra as external secure historian storage or data bridge between SCADA and IT analytics systems, applying all of Acra’s data security arsenal to the data.

Address security risks conveniently

Make developers life easier

Acra contains a set of highly adaptable components, so you don’t need to spend years on the development of home-brewed cryptographic solutions. Acra supports modern tech stack (databases, ORMs, backend frameworks), and once integrated it just works.

Build your solutions faster

Bring your secure product to the market faster. Acra is easy to integrate, deploy, configure, and use without significant changes in existing architecture. Start small with only necessary security modules, add new components when your product grows.

Get a fair price

You can choose different Acra configurations: from a free Acra Community Edition to a highly customized Acra Enterprise solution. We assist with integration, optimisation and provide several support tiers. You can choose the payment plan that fits your use case: from fewer components to a full spectrum of premium features and 24/7 solution support.

Reduce risks with support and assistance

Reduce extra risks and frictions with integration assistance and solution support. We help reorganize data flows and configure Acra for your use case while adhering to the internal and external procedures and specific regulations.

Read latest Acra customer story

Quick migration to field level encryption of governmental data
Quick migration to field level encryption of governmental data GovTech security solution

FSA / Fintech

Quick migration to field level encryption of governmental data

Integrating encryption and data masking for sensitive data stored in MySQL cluster. A combination of transparent SQL encryption via AcraServer and encryption API via AcraTranslator makes Acra fit for complex solutions.

Read story

Evaluate Acra, your way

a

a. Free Acra Community Edition

Check out Acra Community Edition with major data security features: encryption and masking, SQL request firewall, basic intrusion detection, and single configuration policy.

Best for prototyping and small-scale projects.
Acra CE (open source)Evaluate Acra, your way
b

b. Acra open-source engineering examples

Check out Acra engineering examples: a collection of ready-to-try projects with Acra, database, web application, and monitoring tools.

Learn how easy it is to integrate Acra data protection into an existing application.
Acra CE (engineering examples)Evaluate Acra, your way
c

c. Free evaluation playground for popular use cases

Request a free playground that runs Acra Enterprise Edition, a database of your choice and an example client application. We deploy a free playground for one of the popular use cases, using a suitable data model and demonstrating user scenarios.

As a result, your team knows more about Acra functionality and security benefits it brings into your project.
d

d. Paid PoC customized for your use case

Work with our engineering team on proof of concept solution. We deploy Acra for your architecture and use case, encrypt one or several tables, connect your real app to Acra to ensure that the system is working as expected.

As a result, your team is confident that you can attain your security objectives with Acra prior to buy-in.

Licensing and Pricing #

Acra Community Edition

Cryptographic data protection suite with all core security features. Best for prototyping and small-scale projects.

  • Encryption and masking
  • SQL request firewall
  • Basic intrusion detection
  • Single configuration policy
FREE

Apache 2 license, free forever for non-profit and business use

Download Acra CEDownload Acra CE

Acra bespoke solution

Solution built around Acra Enterprise Edition that meets your unique needs and requirements.

  • Customized masks & protocols
  • Customized behavior
  • Use case specific features
  • Engineering and architecture support

Pricing depends on included services and varies on a case-by-case basis.

Acra Enterprise Edition

Full spectrum of premium features for large-scale and enterprise deployments.

  • All Acra features and controls
  • Various support tiers
  • DevOps / SRE tooling
  • Policy management

Pricing depends on number of deployments and features requested. Starting at $10000 annually

See the full feature comparison table

Contact us

Get your Acra up and running fast with the help of engineers who built it!

Ready to start or need more information? Let’s discuss how Acra can solve your data security risks with our assistance in defining goals, integration, configuration, and deployment.

Contact us

Would you like to know more?
Leave your contacts, and our team contacts you shortly to answer questions and address concerns.

Get whitepaper

Apply for the position

Our team will review your resume and provide feedback
within 5 business days

Thank you!
We’ve received your request and will respond soon.
Your resume has been sent!
Our team will review your resume and provide feedback
within 5 business days