Security
What LAB256 touches, records and sends
A tool that asks for a database password has to answer this before the trial. Here it is, with no hunting through the FAQ.
- Agentless architecture
- LAB256 is a desktop application that opens JDBC connections to the database. Nothing is installed on the database server. Close the application and the connection is gone.
- Minimum privileges
- To monitor, a dedicated read-only user is enough. Oracle: read access to the dictionary (SELECT ANY DICTIONARY, SELECT_CATALOG_ROLE) and EXECUTE on DBMS_METADATA to read DDL. PostgreSQL: the pg_monitor role and the pg_stat_statements extension. MySQL: PROCESS, REPLICATION CLIENT and read access to performance_schema and a few tables of the mysql schema. ClickHouse: read access to the system tables. The connection form shows a ready-made script that creates that user; LAB256 shows it and never runs it.
- Commands, only when you confirm them
- LAB256 changes a database only through an action you confirm, such as cancelling a statement, adding a datafile, rebuilding an index, gathering statistics or fixing a plan as a baseline. The confirmation shows the exact statement that will run; afterwards the statement and the database's answer are shown again and written to a local journal. An action is dimmed, with the reason, when the user lacks the privilege. A connection marked read-only runs nothing, and connections tagged production start that way. There is no startup or shutdown, no RMAN, and no DML on application data.
- What is recorded
- Performance metrics per connection: vitals every 10 seconds by default, top SQL and sessions every minute, capacity and memory every 5 minutes, an hourly health check, and the journal of actions. Raw for a day, by the minute for a month, by the hour for up to a year (365 days by default, configurable). Settings shows what each connection keeps, with a switch and a delete for each.
- SQL text off by default
- The history keeps identifiers (SQL_ID) and metrics. SQL text is only recorded if you switch that option on.
- Encryption at rest
- The history file is encrypted at rest. Saved connection passwords are encrypted with AES-256-GCM; by default the key sits in the same folder. Set the optional application password and the key is derived from it and the key file is deleted. There is no recovery: forget the password and the saved passwords are lost, while the connections themselves stay.
- What leaves your network
- Your database data never leaves your machine. The application talks to our server for three things. The licence: activation, deactivation and a check at every start, with the licence key, a hashed machine identity, the platform and the version, plus the computer's name at activation. The update check: the same fields, switchable in Settings › Application. Usage data: the application opening, which screen is opened and the kind of database connected; on by default, off in Settings › Application › Privacy. That switch also covers error reports, which the current version does not send. Never sent: database contents, SQL, results, connection names or passwords. Our server records the IP address of each request.
- Installer integrity
- The Windows installer and every executable inside it are signed by Dados Inteligentes Ltda. Every published installer shows its SHA-256 next to the download button; check it before installing in a controlled environment.
- Offline activation
- For isolated networks, on any plan, the licence is activated by QR code: the application shows the code, you open it on any device with internet access and paste the result back. The monitored machine never has to reach our server, and a licence activated this way is checked on the machine itself.