Encryption at rest
Stored connection strings and API keys are encrypted with AES-256-GCM, under a key derived from a secret only you hold.
Security and privacy
Your database is sensitive. Adminium is built for that.
An admin panel can read and write production data. This page says plainly what Adminium does with yours.
01
Where your data goes
Nowhere but your own machines
Adminium runs on your server or your desktop. Queries go straight from your instance to your database. Nothing passes through us.
Setup reads the schema
Building the admin reads table and column metadata, not row data. After that it is a read-and-write admin: people with the right role can change rows.
Telemetry is off
It stays off unless you turn it on.
AI is optional and yours
With no model configured, no model is called. With one, requests go to the provider or the local server you chose.
02
What is built in
Roles and two-factor sign-in
Permissions per table and per action, and 2FA for anyone who can write.
PII masking
Columns detected as personal data are masked unless a role may see them.
Audit log
Every write is recorded with the person and the time.
Your part
The database role is the real boundary.
Give Adminium the narrowest database role that does the job, put TLS in front of it, and keep the secret in a secret manager. The docs have the full checklist.
- The secret is random, in a secret manager, and backed up
- The database role is the narrowest one that does the job
- TLS in front, and the port not reachable any other way
- Roles assigned per person; nobody is a super admin by default
- Two-factor sign-in on for anyone who can write
- The audit log is read now and then
Open source, so you can check
The code is AGPL-3.0 and public. We make no certification claims; read the source and decide.
Your database already has the data. Give it an interface.
Free and open source. Running on your own machine in about a minute.