Designed to stay inside your infrastructure
SIXTA deploys inside your environment. It does not collect personally identifiable information, and with a local model can run fully air-gapped. Every aspect of how it interacts with your databases is designed to earn and maintain trust — through transparency, consent, and control you can audit.
Runs inside your network
SIXTA deploys within your infrastructure. Your database telemetry, query patterns, and operational data are processed locally. SIXTA does not collect personally identifiable information. Slack and Teams integrations require a connection to api.sixta.ai for message coordination — no database telemetry is transmitted through it. With a local model and custom integrations, SIXTA can run with zero outbound connections.
Read-only by default
SIXTA connects to your databases with read-only credentials. It observes query patterns, collects telemetry, and analyses performance. It cannot modify schemas, alter data, or execute write operations unless you explicitly enable specific autonomous actions.
Your data trains your DBRE
The models that power SIXTA learn from your environment alone. We don't aggregate customer data to train shared models. Your query patterns, topology, and operational intelligence belong to you.
Full audit trail
Every action SIXTA takes is logged with full context — what was invoked, what parameters were used, what the outcome was, and whether it was later rolled back. As approval workflows are implemented, approval status and risk assessment scores will be recorded alongside every action. See the audit log reference for the current schema.
Transparency
SIXTA explains its reasoning in natural language. It shows what data it examined, what patterns it found, what hypotheses it tested, and why it reached its conclusion.
Consent
No change is made without appropriate authorisation. Approval workflows are configurable per action type, per environment, per team.
Auditability
Every action, recommendation, and investigation is logged with full provenance. This is not just a compliance feature — it is how SIXTA builds institutional knowledge.
Boundaries
Blast-radius limits, rollback policies, and escalation paths are first-class configuration. Teams define where SIXTA can act independently and where it must ask.
Reversibility
Where SIXTA acts, it ensures rollback is possible. It never takes an action it cannot describe how to undo.
Isolation
SIXTA deploys inside your infrastructure with no shared tenancy and no credentials stored outside your environment. The reasoning engine is model-flexible — use Anthropic's API, your own internal model, or a fully local model for air-gapped operation. Slack/Teams integrations use api.sixta.ai for message coordination only.
Read-only monitoring
SIXTA connects with read-only credentials, ingests telemetry, and starts learning your environment. It maps database topology, catalogs query patterns, and establishes what normal looks like for your specific systems. Nothing is modified. This is where every deployment starts.
Analysis with human review
SIXTA delivers root cause analysis and specific fix recommendations to Slack, Teams, or your own internal systems. Your team reviews every recommendation before deciding whether to act on it. SIXTA shows its reasoning: what to do, why, and what happens if you don't.
Autonomous resolution with guardrails
For risk-assessed, safe operations, you can enable autonomous execution. Kill a runaway query. Adjust a connection pool parameter. Add a missing index during a maintenance window. Each action type is individually gated, so you can allow index creation but not query termination, or vice versa.
SIXTA assesses risk before every action. It checks impact radius, reversibility, and historical success rate. If the risk exceeds your configured thresholds, it falls back to Level 2 and asks for human approval.
What SIXTA ingests
Database performance telemetry: query execution times, resource utilisation, connection metrics, replication status, and schema metadata. Query patterns and their performance characteristics. System-level metrics from connected monitoring tools (AWS CloudWatch, Performance Insights, Datadog, Percona PMM).
SIXTA does not collect personally identifiable information — PII is excluded by the way SIXTA queries your databases, not filtered after the fact. Performance metadata is sent to the configured LLM endpoint for reasoning — which can be Anthropic's API, your own internal model, or a local model for fully air-gapped operation. See the data flow reference for full details.
What SIXTA does not access
Row-level data. Your actual business data in tables. Personally identifiable information. Application secrets or credentials beyond the read-only database credentials you provide. We have no interest in your data content, only its performance characteristics.
In-Network Deployment
SIXTA deploys inside your infrastructure. No PII collected. Air-gapped operation available with local model and custom integrations.
Audit Logging
Complete audit trail for every SIXTA action, recommendation, and autonomous operation.
Role-Based Access
Granular control over SIXTA's permissions. Each autonomous action type individually gated.
SOC 2 Type II
Working toward SOC 2 Type II certification. Contact us for current status and timeline.
GDPR Compliance
Data Processing Addendum, sub-processor register, and GDPR-aligned Privacy Policy in place.
Penetration Testing
Third-party security assessment and penetration testing program.
Security questions?
We're happy to walk through our architecture, data handling, and compliance roadmap in detail. We built this for teams that take database security seriously.
Request Security Review