Cache transport
Connections from CacheDB to cache and metrics services do not support TLS. Keep them on a trusted network or provide transport encryption through an overlay or service mesh.
CacheDB security
Protect each connection across the database path.
CacheDB’s native proxies terminate TLS from the application and establish a separate verified TLS connection to the database. The console provides identity, role and audit controls for teams operating multiple proxy targets.
Database transport
Encryption is enabled on both proxy legs.
All five native proxies support TLS 1.2 or later from client to proxy and a separate TLS connection from proxy to database. Backend certificates are verified by default. Plaintext requires an explicit opt-out, and a failed TLS handshake never silently falls back to plaintext.
Deployment boundaries
Know where each control lives.
Security depends on the complete deployment, including databases, cache infrastructure, console edge and identity provider.
Console edge
The console expects a TLS-terminating reverse proxy or WAF for externally reachable deployments, including rate limiting and network access policy.
Authentication and roles
Use local accounts or OIDC with Viewer, Operator and Administrator roles. Protected mutations require CSRF tokens.
Audit
Authentication events and protected changes are recorded in an append-only audit log with optional SIEM export.
Multi-tenant console
Operate several proxy targets from one console.
Configure named tenant targets for separate proxy fleets. The console scopes operational views and actions to the selected tenant, whose configuration includes its own cache key prefix and backend servers.
Tenant-scoped operations
Inspect fleet metrics, alerts, scripts and license status in the selected tenant context.
Role-based access
Separate read access, operational changes and administration with built-in roles and optional OIDC.
Protected configuration
Store credentials in protected configuration files and keep secrets out of installation answer files and audit records.
Security review
Map CacheDB to your network and identity model.
Bring your TLS requirements, cache topology, identity provider and proxy fleet layout to a technical review.