Overview
Security is foundational to any modern database - and a key concern for architects, engineering leaders, and enterprise buyers.
SurrealDB has been designed from the ground up with security in mind. It provides robust authentication options, fine-grained access control, encryption in transit, and extensive auditing features.
For the latest certifications, policies, and security updates, visit the SurrealDB Trust Centre.
This article details the security architecture of SurrealDB and provides guidance on how to deploy it safely in production - whether you are handling sensitive PII, operating in a regulated industry, or simply building secure applications.
Authentication and identity
Built-in authentication
Supports SurrealDB-native users and password-based authentication.
Enterprise identity integration
Supports OAuth 2.0, OpenID Connect, SAML, and LDAP for integration with corporate identity providers.
Custom authentication
Extensible via application-level JWTs or external identity proxies.
Authorisation and access control
Fine-grained table and field permissions
Define granular read, write, and delete permissions per role, per resource
Role-based access control (RBAC)
Manage access to data and schema via roles and user groups.
Multi-tenant isolation
SurrealDB namespaces and databases allow strong separation of tenant data in SaaS architectures.
Encryption
Data at rest
Supports strong encryption for data persisted on disk or cloud storage.
Data in transit
All communication can be secured with TLS to prevent eavesdropping and MITM attacks.
Audit and monitoring
Audit logging
Record sensitive operations and changes for compliance tracking and forensic investigation.
Observability
Integrates with modern observability stacks - capture metrics on query performance, slow queries, and operational status.
Third-party monitoring
Compatible with popular log collection and SIEM tools.
Compliance and certifications
For the latest details, visit the SurrealDB Trust Centre.
Current status includes:
GDPR: Fully compatible with GDPR requirements for data privacy and control.
ISO 27001: The SurrealDB company is ISO 27001 certified for information security management.
SOC 2 Type 1: Achieved. SOC 2 Type 2, Cyber Essentials Plus and HIPAA certifications are all in progress.
Regulatory Use Cases: Designed to meet the needs of companies in financial services, healthcare, and other regulated industries.
Security best practices for deployment
Deploy SurrealDB behind a secure reverse proxy with proper TLS termination.
Enforce authentication for all database connections - avoid anonymous access in production.
Use namespaces and databases to enforce logical separation of multi-tenant data.
Apply least-privilege principles with RBAC and per-query permission rules.
Continuously monitor audit logs and metrics for anomalous behaviour.