Sovereignty by construction — the password you never type, the key that never leaves.

Only-data-plane (ADR-0056)

All database requirements go through SS-02; no embedded or per-service engines. One door means tenancy, backups, credentials, audit and encryption are solved once, not per service — and the security surface is one surface.

Tenant isolation (ADR-0071 · 0019)

Tenant-id is a first-class request concern. Shared-Postgres tenants get FORCE ROW LEVEL SECURITY (the owner cannot bypass); shared-MySQL tenants get an application-enforced tenant_id discriminator guarded by platform/dbaas.TenantScope. A cross-tenant read returns zero rows, proven by a CI pen-test.

Dynamic credentials (no static passwords)

Bindings return a Vault secret_ref, never an inline password; consumers draw ≤1h leases. Static passwords in env, Git or ConfigMaps are denied platform-wide by Kyverno. Credential theft has a one-hour blast radius.

Per-tenant KEKs in Vault Transit

At-rest data is envelope-encrypted with a per-tenant key-encryption-key; rotation never re-encrypts the data. Cloud KMS is forbidden by a sovereignty invariant — keys never leave the platform. In-transit is mTLS.

Tamper-evident audit chain (ADR-0014)

Every audited action is appended to a Vault-Transit-signed hash chain; removing or modifying any past entry is detectable. Claim, lease, rotation and placement events are all recorded, with up to 7-year retention on Enterprise.

Analytics boundary (ADR-0068)

Direct analytical reach-in to operational databases is forbidden. Analytics engines (ClickHouse, Iceberg, Trino) are reserved behind SS-09 Prism; facts land there via CDC/batch. The operational plane stays operational.