Databunker

Databunker is a self-hosted application designed for the tokenization and secure storage of personally identifiable information, protected health information, and know-your-customer data. It functions as a secure vault that segregates sensitive records from primary application databases to reduce the risk of data exposure. The software is deployed as a server, often via Docker containers, and provides a NoSQL-like API for backend integration to ensure that sensitive data is handled outside of the main application logic.

Users interact with the system by sending sensitive data through API calls, in exchange for UUID tokens. These tokens are stored in the main application database as references, ensuring that plaintext sensitive information never resides in the primary data store. This approach prevents attackers from retrieving plaintext data through common vulnerabilities like SQL injection or unfiltered GraphQL queries. The system is built in Go for high performance and supports MySQL and PostgreSQL for its underlying storage.

Key features

• Tokenization engine that generates UUIDs for safe data referencing
• AES-256 encryption for all personal records at rest
• Hash-based indexing for secure search queries
• Built-in protection against SQL and GraphQL injection attacks
• Restricted bulk retrieval to prevent large scale data leaks
• REST API with OpenAPI specification and SDK support
• Consent management and automated data minimization tools
• Audit logging and fine-grained access control

The architecture focuses on physical data segregation, moving sensitive fields out of the application's main database into the Databunker vault. It includes specific tools to assist with regulatory requirements such as the right to be forgotten, data portability, and the right to rectification. Integration is handled via a REST API, and the project provides support for Passport.js for identity management. The system is designed to scale horizontally and includes options for automated backups and high availability to ensure data persistence.

This tool is intended for developers and organizations requiring a secure, compliant method for handling sensitive user records while maintaining a decoupled data architecture.