EMET | DaTamoon Ltd.

A DaTamoon Product

Universal Database Security Wire Proxy

Your organizational zero-trust database security layer built on threshold cryptography. Transparent, column-level AES-256-GCM encryption secures sensitive information before it reaches the disk—so even a breached database yields mathematically useless ciphertext.

Overview

EMET is a next-generation database security layer designed to neutralize the threat of database exfiltration and insider threats. By decoupling data access from data storage, EMET ensures that your underlying database infrastructure—and anyone with direct access to it—remains completely blind to your most sensitive payloads.

How EMET Works

EMET combines four mechanics to make plaintext PII structurally impossible to exfiltrate from your databases:

Threshold Key Splitting (2-of-3 Quorum) Data Encryption Keys (DEKs) are split into shares via Shamir's Secret Sharing and distributed across an isolated Vault quorum. No single node or administrator ever holds the full key.

Universal Wire Proxy A transparent SQL proxy intercepts queries in-flight, encrypting and decrypting protected columns on the wire. Your application and schemas remain completely unchanged—zero code modifications required.

Decoupled Key & Storage Domains Cryptographic key reconstruction occurs strictly in volatile proxy memory; the physical database storage layer never touches or stores the reconstruction parameters.

Selective Column-Level Encryption Protect exactly the columns that matter—high-CAC PII, credentials, financial fields—while the rest of your database operates at full native speed.

The Proof Is in the Payload

EMET does not rely on legacy perimeter defense; it mathematically locks your data at the most granular level. If a malicious actor, or even a highly privileged security_admin, bypasses the EMET gateway to query the database directly, the data is entirely inaccessible.

DaTamoon is currently in its Seed phase, with active design partner POC scheduling underway. EMET applies surgical payload protection:

Operational Continuity: Standard routing and indexing fields in the clients and employees tables (such as full_name, email, role, and date_of_birth) remain in plaintext, allowing the database to execute fast, standard queries without disruption.
Payload Nullification: Highly sensitive targets—such as ssn_encrypted, salary_encrypted, home_address_encrypted, and credit_card_encrypted—are stored strictly as impenetrable hexadecimal strings (e.g., \x377f038d... and \xb14b557f...).

Without the active, authenticated presence of the EMET gateway, the database server itself has absolutely no mechanism to decrypt these strings, rendering stolen data mathematically useless to attackers.

⚡ Live Benchmark Proven

Zero-downtime cryptographic key rotation completed across 4 policy-enforced columns in 5.827 seconds with 0.0s application interruption.

Core Business Advantages

Zero Plaintext Exposure

Unlike legacy database encryption that must decrypt data into the server's memory to execute queries, EMET ensures plaintext never touches the database layer, effectively eliminating memory-scraping vulnerabilities.

Uncompromised Performance

By isolating the heavy cryptographic lifting specifically to sensitive columns, your organization maintains high-speed transactional performance across the rest of the database.

Regulatory Peace of Mind

Easily satisfy strict data sovereignty and privacy regulations (such as GDPR). If a perimeter breach occurs, the exfiltrated ciphertext cannot be reverse-engineered or subjected to offline dictionary attacks.

Instant Data Erasure

Achieve absolute compliance with the "Right to be Forgotten" by instantly revoking a specific record's access parameters, permanently locking that individual's historical data across all live tables and backups.