Capabilities ApexAI Data Gate
Capability · Data security
Protect the data, not just the database.
Sensitive data is rarely stolen from a disk. It leaks while it is being used: through an API that returns too much, a report that copies a column, an application that holds plaintext it never needed. ApexAI Data Gate protects each sensitive field as data moves through your applications and APIs, and turns data access into governed APIs with a policy on every field.
Status: In development Field-level protection, database onboarding and query rules run today as a preview; Data Gate as a function of the ApexAI gateway, protecting requests and responses and turning databases into governed APIs, is in development.
Beyond the database firewall
For years, data security meant two things: encrypt data at rest, and put a firewall in front of the database to watch the queries. Both still matter, and both miss where data actually goes. Once a query is allowed, the full value travels in the clear to the application, into logs, through APIs and on to partners. Encryption at rest does nothing once the data is read, and a database firewall sees only the perimeter of one database.
ApexAI Data Gate starts from the other end. It treats each sensitive field as the thing to protect, wherever it goes. Access to data happens through governed APIs rather than open database connections, and a policy decides for every field, for every caller and purpose, whether it is shown, masked, encrypted or withheld. Query rules are still there, as one layer among several, not the whole answer.
How Data Gate protects data in use
Field-level policy
Each sensitive field carries its own protection, chosen by its classification, the caller’s role and the purpose of the request.
Masking by role
People and applications see only as much of a value as their role needs, for example the last digits of an account number.
Field encryption
Sensitive values travel and rest encrypted, and are decrypted only for callers allowed to see them.
Search without decrypting
Exact-match lookups on protected fields work without turning them back into plaintext.
Compute on encrypted data
Selected calculations, such as sums and grouped sums, run on fully homomorphic ciphertexts, so the server never sees the values.
Post-quantum protection
Long-lived sensitive fields can be wrapped with post-quantum encryption against harvest now, decrypt later.
From a database to governed, protected APIs
01
Connect
Register a database by secret reference, directly or through a tunnel agent for private networks, without putting credentials in configuration.
02
Classify
Tables and columns are discovered and classified locally, and a protection is suggested for each sensitive field.
03
Expose as APIs
Data access is published as governed APIs, read-only by default, paged and parameterised, with an owner and a purpose.
04
Protect in use
Every call passes the field policy on the way in and on the way out, through ApexAI Causeway.
05
Watch and respond
Every decision is logged; unusual access to sensitive fields becomes evidence for the Autonomous SOC, and responses go through ApexAI Drawbridge with human approval.
Legacy database firewall and ApexAI Data Gate
| Question | Legacy database firewall | ApexAI Data Gate |
|---|---|---|
| What is protected | The database perimeter | Each sensitive field, wherever it travels |
| Where it works | In front of one database | Through the APIs and applications that use the data |
| What it can do | Allow, block or alert on a query | Show, mask, encrypt, compute on ciphertext or withhold, per field, role and purpose |
| How access happens | Direct database connections | Governed APIs with owners, purposes and audit |
| What it learns from | Static rules | Access patterns joined to entities in the Autonomous SOC |
Questions
What does protecting data in use mean?
It means protecting data while applications read and process it, not only when it is stored or sent. With field-level protection, a sensitive value stays masked or encrypted for every caller who does not need the plaintext.
Is ApexAI Data Gate a database firewall?
No. It includes query rules, but its focus is the data itself: governed APIs and a protection policy on every sensitive field, applied as data moves through applications and APIs.
Do our applications have to change?
The aim is that applications only point to a new address. Existing APIs can be imported from their specifications and keep their contract, while the gateway applies the field policy.
Does our data leave our environment?
No. ApexAI runs on-premises or in your private cloud, classification runs locally, and private databases connect through tunnel agents without being opened to the internet.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.