Security
Your data, your infrastructure
Astapa is self-hosted and open source. You control everything.
Security model
Self-hosted by design
Astapa runs entirely in your infrastructure. No data leaves your network. No external dependencies or phone-home.
Open source
Full source code available on GitHub. Audit the code yourself or hire a third party. No black boxes.
Data stays in your database
Shadow tables and staged mutations exist in your PostgreSQL instance. We never copy production data anywhere.
Proxy-only architecture
Astapa intercepts queries but doesn't store results. Query text passes through in transit only.
Data flow
What data does Astapa see?
Astapa proxies PostgreSQL wire protocol. It sees query text and results in transit to rewrite table references. It does not persist query results.
What does Astapa store?
Session metadata (session ID, timestamps, table names affected). Shadow tables with staged mutations. All stored in your PostgreSQL database, not externally.
Does Astapa phone home?
No. Zero telemetry, no analytics, no external API calls. The proxy runs fully air-gapped if you want.
How do I secure the API?
The HTTP API (port 8080) should be behind your firewall or VPN. Use your existing network security controls. The proxy doesn't include auth — bring your own.
Found a vulnerability?
We take security seriously. Please report vulnerabilities responsibly.
Report a vulnerability