App Security

How Simpl Desktop protects your database connections and data.

Overview

As a native desktop application, Simpl takes a fundamentally different approach to security: your credentials never leave your machine. There are no servers storing your connection strings, and your database queries go directly from your computer to your database.

The Desktop Advantage

Your Credentials Stay Local

Unlike web-based database tools, Simpl Desktop stores everything locally:

Aspect How It Works
Connection strings Stored only on your device
Encryption OS secure storage (safeStorage) when available
Database queries Direct connection from your computer
Our servers Never see your credentials or data

This means:

  • No server-side storage - We can't leak what we don't have
  • No network hops - Your queries go directly to your database
  • Full control - Your data stays under your control

Local Encryption

How Credentials Are Protected

Even on your local machine, your connection strings are encrypted using your operating system's secure credential storage.

When available, Simpl uses Electron's safeStorage API, which leverages your OS-level encryption:

Platform Storage Method
macOS Keychain
Windows DPAPI (Data Protection API)
Linux Secret Service API (e.g., gnome-keyring)

If safeStorage is unavailable on your system, Simpl falls back to file-based AES-256-GCM encryption with a locally-stored key.

Aspect Implementation
Primary OS secure storage (safeStorage)
Fallback AES-256-GCM with unique IV per connection
Key Size 256 bits

Your credentials are:

  • Encrypted before being stored on disk
  • Decrypted only when establishing connections
  • Never transmitted to any external servers

Query Security

SQL Injection Prevention

Simpl uses multiple layers to prevent SQL injection:

  1. Identifier allow-listing - Table and column names are validated against the introspected schema
  2. PostgreSQL identifier quoting - All identifiers use proper quoting ("schema"."table")
  3. Parameterized queries - All user values are passed as parameters, never concatenated

Example

When you filter for name = "John":

-- What Simpl executes (safe)
SELECT * FROM "users" WHERE "name" = $1
-- Parameters: ['John']

-- NOT this (unsafe)
SELECT * FROM users WHERE name = 'John'

Query Timeouts

All queries have a 10-second timeout to prevent:

  • Runaway queries from affecting database performance
  • Connection pool exhaustion
  • Hanging connections

Direct Database Connections

No Middlemen

When you connect to a database with Simpl:

  1. Your computer connects directly to your database server
  2. No proxy servers or intermediaries
  3. No data passes through our infrastructure
  4. Connection uses your database's native security (SSL/TLS)

Network Security

For maximum security, configure your database connection with:

  1. SSL/TLS connections - Add ?sslmode=require to your connection string
  2. IP allowlisting - Restrict database access to known IPs
  3. VPN/Private networks - Use private database endpoints when available

SSL Connection Example

postgresql://user:pass@host:5432/db?sslmode=require

SSL modes:

Mode Description
require Encrypt connection, don't verify certificate
verify-ca Verify server certificate is signed by trusted CA
verify-full Verify certificate and hostname

Access Control

Database Credentials

Simpl connects using the credentials you provide. Access is limited by:

  • Your database user's privileges
  • PostgreSQL's built-in access control
  • Your database's network policies

Recommendation

Create a dedicated database user for Simpl with appropriate permissions:

-- Example: Read-only access
CREATE USER simpl_readonly WITH PASSWORD 'secure_password';
GRANT CONNECT ON DATABASE mydb TO simpl_readonly;
GRANT USAGE ON SCHEMA public TO simpl_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO simpl_readonly;

For editing capability:

-- Example: Read-write access
CREATE USER simpl_readwrite WITH PASSWORD 'secure_password';
GRANT CONNECT ON DATABASE mydb TO simpl_readwrite;
GRANT USAGE ON SCHEMA public TO simpl_readwrite;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO simpl_readwrite;

What We Store

On Your Machine

Data Purpose Protection
Connection strings Database access OS secure storage (safeStorage)
Schema cache Performance Local storage
Layout configs User preferences Local storage

On Our Servers

Data Purpose
License key Verify your purchase
Email address Account management

We do NOT store:

  • Your database credentials
  • Your database data
  • Your query history
  • Any information about your database contents

Best Practices

For Connection Credentials

  1. Use dedicated users - Don't use superuser/admin accounts
  2. Limit privileges - Grant only necessary permissions
  3. Rotate passwords - Update credentials periodically
  4. Use SSL - Enable encrypted connections

For Database Configuration

  1. Enable SSL - Require encrypted connections
  2. Allowlist IPs - Restrict network access
  3. Audit logging - Enable PostgreSQL logging
  4. Regular backups - Maintain backup strategy

Privacy

Data Privacy

Simpl Desktop is designed with privacy at its core:

  • We never access your database data
  • We can't see your connection information
  • We don't analyze or mine your database contents
  • Your queries are executed locally, not through our servers

Questions

For security-related questions:

Next Steps