databunker.
Sign in ↗Book a demo
THE CUSTOMER DATA VAULT

Customer data.
Under control.

Databunker Pro is an encrypted vault for sensitive records and files. Your applications keep token references. You control access to the originals.

Already protecting 20M+ records in production

Start a free trial Book a demo

Self-hosted or managed · Built for developers

THE VAULT, IN MOTIONILLUSTRATIVE FLOW
A protected home for the originals.Customer records and files enter Databunker through its API. The vault encrypts the originals and controls retrieval. Your application keeps the returned record reference. Customer record nameAlex Morgan email[email protected] PROFILE passport.pdfLinked to customerATTACHED FILE Your application Keep the record reference a21fa1d3-8b4c-… Access by policyYour rules apply ORIGINALS STAY PROTECTED THE ENCRYPTED DATA VAULT 01 / ORIGINALS03 / REFERENCE02 / PROTECT

Send the profile and its files to the vault.

FAMILIAR INFRASTRUCTURE.
FEWER NEW MOVING PARTS.

PostgreSQLMySQLAmazon S3DockerKubernetesOpenShift
Explore support
01 / YOUR STACK, WITH A VAULT

Same application.
A new home for sensitive data.

Databunker sits beside your application backend. Keep business data in your database; move sensitive profiles and files behind the vault API.

Explore the architecture
LIVE ARCHITECTURE WALKTHROUGH
ILLUSTRATIVE EXAMPLE
Original data
Stored encrypted in vault backends
Record reference
Identifies a profile; grants no access
API credential
Authorizes your backend’s requests
  1. 01
    Your app → DatabunkerProfile + file + API credential
  2. 02
    Databunker → Vault databaseEncrypted profile
  3. 03
    Databunker → File backendEncrypted file
YOUR APPLICATION STACKBusiness logic stays here
VAULT SERVICESelf-hosted or managed
CONFIGURED STORAGEChosen for your deployment

Your application

Backend / service

Sending a profile + file
Scoped credentialProfile + file

Application database

Your existing business data

customer_id1024
user_token—

Awaiting a record reference

Databunker Pro

The controlled retrieval boundary

01
Authenticated APIProfiles + attached files
02
Access policyEvaluate the caller’s permissions
03
Encryption + retrievalOriginals returned only when allowed
Encrypt before storage

Vault database

Encrypted customer records

PostgreSQLMySQLOracle

Separate from your application database

File backend

Encrypted file content

S3GCSAzure BlobLocal disk

Files linked to a customer record

01 / 04Playing

Originals go into the vault.

Your backend sends the profile and attached file through the authenticated API. Databunker encrypts their contents before writing to its configured storage.

ILLUSTRATIVE INPUT
profile: { name: "Alex Morgan" }
file: passport.pdf

The API credential authorizes the request.

02 / THREE WAYS TO START

Follow the data.
Find your use case.

See exactly what changes in an onboarding flow, an AI application, or an existing customer database.

01 / KYC & ONBOARDING↗

The profile.
And the proof.

Link verified customer details and identity documents. Control who can retrieve each.

IDENTITYDOCUMENT
Customer #1024
Profile encrypted
2 linked files
Scoped access
Follow the onboarding flow →
02 / AI WORKFLOWS↗

Useful context.
Fewer raw details.

Tokenize identified sensitive values before a model call. Restore only authorized values afterward.

YOUR APPLICATION

Reply to [email protected]

↓ DETECT + TOKENIZE
MODEL INPUT

Reply to [EMAIL:a21f…]

Trace the model call →
03 / CUSTOMER DATABASES↗

Your user table.
A smaller footprint.

Move sensitive profiles into the vault. Keep the record reference beside your business data.

YOUR APPLICATION DATABASE

customer_id1024

user_tokena21fa1d3-…

Walk through a migration →
03 / RECORDS + FILES, TOGETHER

One customer.
A clear set
of permissions.

A profile in one database. An ID scan in another bucket. Bring them under the same controls, so access follows the person and the purpose.

Share only what’s needed

Mask fields and scope access to records and documents.

Give data a lifecycle

Set retention windows and enable profile version history.

See how permissions work
Customer workspacePOLICY EXAMPLE
AM

Alex Morgan

Customer #1024
In vault
View as
Email address***MASKED
National ID***MASKED
ATTACHED DOCUMENTS 2 FILES
passport.pdfIdentity document
Restricted
address-proof.pdfSupporting document
Restricted
Support access · masked profileDocument access restricted by this example policy
POLICY APPLIED

Support gets the context to help. Identity documents stay restricted.

04 / DATABUNKER CLOUD

What the managed vault
takes off your plate.

No vendor can take on your legal accountability — under GDPR you remain the controller. Here is where the line sits.

Stays with you

  • Being the controller, and your privacy notice
  • Deciding who on your team may read data
  • Protecting your API credentials
  • Signing and filing a breach notification
  • Keeping retrieved plaintext out of your logs and backups

Databunker handles

  • Per-record encryption, key management and rotation
  • Access policies and field masking on every read
  • An audit log of every read, so the blast radius is provable
  • Deletion and access requests in one API call
  • Hosting, patching, backups and restore testing

That left-hand list fits on one page. Most teams find that’s the whole reason to do this. Self-hosting? Hosting, patching and backups move to your column.

FROM EXPLANATION TO IMPLEMENTATION

One record.
Your first API call.

Create a profile. Store the returned reference. Add authorized retrieval where your application needs the original values.

Build your first flow
POST/v2/UserCreate
{
  "profile": {
    "name": "Alex Morgan",
    "email": "[email protected]"
  }
}
↓ RESPONSE · EXAMPLE"token": "a21fa1d3-8b4c-…"
YOUR INFRASTRUCTURE, YOUR CHOICE

A vault that fits
the way you deploy.

Self-host with familiar container tooling, or choose a managed vault. Use supported relational databases and file backends.

Compare deployment options
RUN THE VAULT
DockerKubernetesOpenShiftSelf-hosted
or managed
→
ENCRYPTED RECORDS
PostgreSQLMySQLAmazon RDS / AuroraOracle
+
ENCRYPTED FILES
Amazon S3Google Cloud StorageAzure Blob Storageor local disk
A FEW GOOD QUESTIONS

The details
matter.

Here’s what teams ask before putting the vault in their architecture.

Go deeper in the docs
Does Databunker replace my database?

Your application database can stay. Databunker stores the sensitive profiles and files you move into it, while your application keeps references. Reads and writes for migrated data go through the vault API.

Will this slow down my app?

Reads are a hashed-index lookup: about 14 ms median in our published benchmark, flat from 10M to 100M records. Single writes take 3–10 ms over a real network, and bulk imports reach about 12,000 records per second. The Go service is stateless, so you add instances as traffic grows.

What if Databunker goes down?

Databunker Pro is a stateless Go service: run several instances behind a load balancer, with PostgreSQL replication and failover underneath, so losing one node doesn’t take reads down. On the managed vault, multi-AZ failover is included.

Can we deploy it in our own infrastructure?

Yes. Databunker Pro supports self-hosting with Docker Compose, Kubernetes (Helm chart) or OpenShift, with supported database and file backends. A managed option is also offered. For self-hosting, your team manages infrastructure, backups, and operational security.

Where does the data live?

Wherever you run the vault: your own cloud account, on-premises, or a managed vault in the region you choose. For multiple jurisdictions (EU, India, US…) you run one vault per region, so each country’s records stay in that country.

Is a token the same as an access credential?

No. A record token identifies stored data. An API credential authorizes the request. Applications still need appropriate credentials and permissions to retrieve original values.

What happens during a migration?

You don’t have to migrate everything at once — start with one service or one table. Backfill records and change application paths in stages, verify the results, and then cut over. Removing old fields does not erase copies already held in historical logs, replicas, or backups; those need their own retention and cleanup plan.

Can we use it with AI applications?

Yes. The documented pattern replaces identified sensitive values with tokens before a model call, then restores authorized values afterward. Free-text detection is a separate step; its coverage determines which sensitive values are protected.

LESS SPRAWL. MORE CONTROL.

Give sensitive data
a proper home.

Walk through your architecture with a Databunker engineer.
Find the right place to start.

Book a demo Start a free trial
Managed trial · No credit card required
Start a free trial