Control production database access without slowing engineers down

Empower Your Engineering Team: Secure and Compliant Production Data Access, State of the art DevOps with Auditing and MCP for AI Agents

Deploy Open-Source Get In Touch

App screenshot shows data access request form and approval workflow

Members of Teams using Kviklet.

Interactive demo

Explore database access with Kviklet

Try Single Query or Access & Proxy to request, approve, execute, and inspect database activity.

Choose Single Query or Access & Proxy below to begin.

Loading interactive demo…

Want a walkthrough for your team?

The Kviklet access flow

From sign-in to audit trail.

Request, approve, execute, and audit - all in one place

Single sign-onOIDC · LDAP · SAML

Approval gatePull-request like

SQL clientvia approved proxy

Execute

LogAudit trail

MySQL

PostgreSQL

MariaDB

MongoDB

Identity providersAccess pathsProduction databases

Democratize access without lowering security. Increase engineering productivity.

Try the interactive demo

Help catch mistakes before they reach production.

Open source

Kviklet is built in the open because infra and developer tools should be transparent, inspectable, and shaped by the community.

Auditable access

Keep a record of who accessed a database, what they ran, and when.

Self-hosted

Self-host with Docker in your own environment.

Your existing identity provider

API keys

Connect scripts and integrations to Kviklet with API keys. Available with Enterprise.

Works with

PostgreSQL
MySQL
MariaDB
SQL Server
MongoDB

MongoDB is supported through the web application. The database proxy does not support MongoDB.

Access Governance for every connection

Choose who can request access, who can approve it, and how many approvals are required.

Example policy configuration

KvikletPolicy
Engine

Read-only access

Allow access without review where appropriate.

No review required

Production changes

Require a peer or designated reviewer.

Peer review

Sensitive connections

Require additional reviewers for access to PII or credit card information.

Additional approvals

Zero-trust principles for database access

Apply least-privilege access and approval rules per connection. Keep records of requests, approvals, and database activity to support compliance efforts for:

ISO/IEC 27001
SOC 2
NIST CSF
PCI DSS
HIPAA
EU GDPR
EU DORA

Pricing

Self-hosted. Priced simply.

Choose Open Source or Enterprise for your team. Both run in your environment, with professional services and forward-deployed engineering available when you need hands-on help.

MonthlyAnnual· 2 months free

Open Source

Core database access workflows, free to use.

€0

Free to use.

Deploy Open Source →

Included in Open Source:

OIDC and LDAP SSO
Single-query review and approval
Time-limited browser sessions
Role-based connection access
Basic audit log
Slack notifications

Enterprise

For teams that want to use their own tooling and need advanced access controls, identity integration, and priority support.

€3/ user / month

Billed monthly.

Subscribe now →

Everything in Open Source, plus:

SAML SSO
Require approvals from specific roles
Database proxy for your SQL client
Role sync with your identity provider
Audit log filtering and exports
API keys for programmatic access
Slack approvalsComing soon
Priority support

Prices exclude applicable tax. Choose your number of seats at checkout.
We email your license and setup instructions after payment.

Professional Services & FDE

Hands-on help with deployment, custom integrations, and forward-deployed engineering for your team.

Deployment and configuration
Custom integrations and features
Forward-deployed engineering

From the Kviklet blog

Ideas for safer and faster
production access

View all articles

Engineering culture

Should developers have production access?

Why engineers need access to production—and how to manage the risks.

Jascha Beste

Apr 2, 2024Read article

Practical guide

A practical guide to production database access

Build an access workflow around individual identities, approvals, and audit trails.

Jascha Beste

Mar 14, 2024Read article

Perspectives

Is database access broken by design?

How production access practices change as engineering teams grow.

Daniel Nguyen

Oct 4, 2023Read article

The founders

The people behind Kviklet

We’ve both seen firsthand how poor production access practices can lead to major incidents.

We’re building Kviklet to help engineers get the access they need while keeping production safe.

Jascha Beste
Co-founder
Jascha is a software engineer on the AI and Agents team at TigerData, the company behind TimescaleDB. Previously, he worked at fintech company Scalable Capital.
LinkedIn X
Dan Nguyen
Co-founder
Dan is a forward deployed engineer on the Agent Platform team at ElevenLabs. Previously, he worked at Uber and as a cybersecurity engineer at the German Cybersecurity Organization (DCSO).
LinkedIn X

FAQ

Everything you need to deploy Kviklet and govern database access.

Deployment guide

: Kviklet gives your team three paths to controlled database access:
Single-statement access: The standard for critical data access. Developers submit a SQL statement for review before it runs, helping reviewers catch mistakes before they affect production.
Database proxy Enterprise: For engineers who want to keep using their preferred tools, such as DBeaver or psql in the terminal. Developers request an access window, connect through Kviklet’s proxy, and work in their existing client while Kviklet records the statements they execute.
MCP Coming soon: Let AI agents safely request access and work with production databases while keeping humans in the approval loop. We expect engineers to increasingly access databases through ChatGPT, Codex, and Claude, just as they already use agents to manage infrastructure.
: Kviklet supports PostgreSQL, MySQL, MariaDB, Microsoft SQL Server, and MongoDB through its web application.
Enterprise also includes a database proxy for PostgreSQL, MySQL, and MariaDB. Developers can keep using their preferred database clients, such as DBeaver or psql, during an approved access window. Microsoft SQL Server and MongoDB are supported through the web application, but not through the proxy.
: Yes. Kviklet includes an experimental Kubernetes access feature that lets engineers request approval to run commands inside Kubernetes pods through the web application.
You can configure approval requirements for each Kubernetes connection. Kviklet records the executed command and its target namespace, pod, and container in the audit history, with optional storage of command output. The feature currently focuses on individual command execution.
This feature is still experimental and is not recommended for production use. We may develop it further if there is enough interest. Please create an issue on GitHub to let us know you’re interested and share your use case.
: Kviklet is fully self-hosted and operated by your team. We ship Docker images and a Helm chart for easy deployment in your infrastructure. Kviklet uses a PostgreSQL database to store its configuration, access requests, and audit history.
Your team is responsible for securing the instance. We recommend network segmentation and appropriate access controls to prevent unapproved access to the platform.
We have deployed Kviklet in many production environments and can help with questions about your setup. Follow the deployment guide, or contact us.
: You decide what each role can do on each database connection and when approval is required. For example, a role can read a less sensitive database without approval but need approval to write. On a sensitive database, the same role can require approval for both.
Open source: Configure access by role and the number of approvals required.
Enterprise: Sync users’ roles automatically through preconfigured identity provider mappings, and optionally require approval from specific reviewer roles.
: Approval requirements depend on the connection, the user’s roles, and whether the access is for reading or writing. You can allow read-only access to non-confidential data without approval while requiring review for writes or access to sensitive data.
When approval is required:
Single-statement access: Reviewers approve the submitted statement before it runs.
Temporary access: Reviewers approve a time-limited access window. The requester can execute multiple statements during that window without separate approval for each one.
Kviklet records the executed statements in its audit history.
: Kviklet records access requests, reviews, and executed statements, including who performed them, the database connection, and execution time. Depending on the execution path, metadata can include runtime, the number of rows returned, and success or error information.
Query results are not stored by default. If an administrator enables result storage for a connection, Kviklet can store the first 500 rows in the event history. Kviklet records activity that passes through it; direct database connections outside Kviklet are outside its audit trail.
Enterprise adds audit filtering and exports.
Coming soon: Administrator-configured controls to omit statement text from audit logs when it contains PII or other sensitive information.
: Kviklet supports single sign-on through OpenID Connect and LDAP, including Google Workspace through OpenID Connect. Enterprise also supports SAML and role synchronization with your identity provider.
When someone leaves your team, deactivate their Kviklet account to remove their access and invalidate their active Kviklet sessions. Their historical requests and audit records remain available.
Pair removal from your identity provider with deactivation in Kviklet to terminate existing Kviklet sessions.
: Kviklet provides dry runs for supported SQL connections when enabled in the connection settings. A dry run executes a statement within a transaction and then rolls it back, helping you check its behavior before execution.
Dry runs are not available for temporary-access requests. Rollback behavior depends on the database and the statement, so a dry run cannot guarantee that every operation or side effect can be reversed.
We are working on more features to help users craft correct, secure SQL statements before they reach a human reviewer or the production system.
: The open-source edition is free to self-host and includes database access requests, approval workflows, OIDC and LDAP authentication, and basic audit history.
Enterprise adds SAML, role synchronization, required reviewer roles, database proxy access, API keys, and audit exports. It costs €3 per user per month or €30 per user per year, excluding applicable taxes.
Coming soon to Enterprise: Slack approvals, so reviewers can approve or decline requests directly from Slack.
See pricing for the current plans.
: Yes. Contact us to request an Enterprise trial. We will support your team during the evaluation, including help with deployment, configuration, and questions about your access workflows.
Enterprise runs in your self-hosted Kviklet instance. Once you receive a license file, upload it in Settings using an account with permission to edit the configuration.
Contact us to arrange a trial.
: Yes. You can run separate Kviklet instances for development, staging, and production under the same Enterprise license, provided they are used by the same legal entity and remain within your purchased seat limit.
: Kviklet makes it easier to implement Zero Trust and the principle of least privilege through role-based permissions, configurable approvals, time-limited access, and an audit trail of database activity.
These controls help your team implement access-control and accountability requirements found in many compliance frameworks, supporting your ISO/IEC 27001, SOC 2, NIST CSF, PCI DSS, HIPAA, EU GDPR, and EU DORA efforts.
Kviklet is not independently certified. It is fully self-hosted and operated by your organization; we do not host your databases or process their data on your behalf as part of the self-hosted deployment.
Your team is responsible for securing the instance, including appropriate network segmentation and access controls. For security documentation or help assessing your deployment, contact us.

Need help with your deployment?

Talk to our team

Control production database access without slowing engineers down

Empower Your Engineering Team: Secure and Compliant Production Data Access, State of the art DevOps with Auditing and MCP for AI Agents

Members of Teams using Kviklet.

Explore database access with Kviklet

From sign-in to audit trail.

Democratize access without lowering security. Increase engineering productivity.

Open source

Auditable access

Self-hosted

Your existing identity provider

API keys

Access Governance for every connection

Read-only access

Production changes

Sensitive connections

Zero-trust principles for database access

Self-hosted. Priced simply.

Open Source

Enterprise

Professional Services & FDE

Ideas for safer and faster production access

Should developers have production access?

A practical guide to production database access

Is database access broken by design?

The people behind Kviklet

Jascha Beste

Dan Nguyen

Ideas for safer and faster
production access