Overview
Databases usually hold the personal data that UK GDPR Article 32 requires you to protect with appropriate technical measures. Our assessments review access, encryption, auditing and exposure for SQL Server, PostgreSQL, MySQL, Oracle and cloud-managed databases.
Every major data breach ultimately ends at a database. Common causes are surprisingly simple: databases reachable from the internet, shared or over-privileged accounts, default settings, missing encryption and no record of who accessed what.
Our database security service reviews configuration against hardening benchmarks, audits users, roles and privileges, checks network exposure and encryption, and evaluates logging and monitoring. We then help you implement fixes with minimal disruption to applications.
For regulated data — payment cards, health records, personal data — we map findings to the controls your auditors will ask about.
How our managed services work for UK organisations
- Cover through UK nights, weekends and bank holidays, when in-house teams are offline
- Escalations go to your named UK contacts by phone, email or Microsoft Teams, following agreed severities
- Monthly service reviews scheduled within UK business hours, with evidence packs for ISO 27001, Cyber Essentials and the NHS DSPT
- Data processing agreement covering transfers from the UK, using the IDTA or UK Addendum where personal data is involved
What's included
Our approach
- InventoryIdentify database instances, engines, versions and data sensitivity.
- AssessmentConfiguration, privilege and exposure review.
- Risk prioritisationFindings ranked by data sensitivity and exploitability.
- Hardening supportGuided or managed implementation of fixes.
- MonitoringIntegration of database activity with SOC monitoring.
What you receive
- Database security assessment report
- Privilege and access review
- Hardening configuration baseline
- Encryption and backup recommendations
- Monitoring use cases for the SOC
Standards & frameworks
- CIS Benchmarks
- PCI DSS Req. 3, 7, 8, 10
- ISO/IEC 27001
- NHS DSPT
- UK GDPR & DPA 2018
- Cyber Essentials
Frequently asked questions
Which databases do you support?
Common engines including MySQL/MariaDB, PostgreSQL, Microsoft SQL Server, Oracle, MongoDB and managed cloud databases.
Will hardening break our applications?
We review application dependencies before changes and stage hardening in a test environment where possible.
Can database monitoring feed into the SOC?
Yes. Database audit logs can be onboarded to our managed SOC for detection of suspicious access.
Can you support UK organisations from India?
Yes. All services are delivered remotely by our team in India. India is 4.5 hours ahead of UK time during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps with yours every morning and afternoon. Testing windows and escalation contacts are agreed around your UK schedule, and 24/7 services run around the clock.
Where is our data processed?
Engagement data is handled by our team in India under NDA, with encrypted storage, least-privilege access and secure deletion at the end of the agreed retention period. We can sign a data processing agreement using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses where personal data is involved.