SQL Studio & gateways
Query in the browser or connect through PostgreSQL, MySQL, and SQL Server client gateways.
Self-hosted · Open source
SQL access, under control.
Give developers one place to run SQL. Keep authentication, policies, masking, approvals, and every activity event under your control.
Your databases remain external and under your control.
ROWSET STUDIO
1SELECT * FROM accounts
2ORDER BY id LIMIT 50;
2ORDER BY id LIMIT 50;
▦ ResultsMessagesHistorySaved
| id | customer_id | iban 🔒 | card_number 🔒 | balance |
|---|---|---|---|---|
| 1 | 1842 | TR••••0001 | •••• 0001 | 420.33 |
| 2 | 2091 | TR••••0002 | •••• 0002 | 86.70 |
| 3 | 3104 | TR••••0003 | •••• 0003 | 1,200.00 |
| 4 | 4028 | TR••••0004 | •••• 0004 | 64.12 |
🔒 2 columns masked
One control plane
PostgreSQL
MySQL
SQL ServerBuilt for production access
Freedom for developers. Guardrails for everyone.
Rowset combines a browser SQL Studio with database client gateways, so policy follows the user whichever workflow they prefer.
AST-based protection
Unsafe SELECT, UPDATE, and DELETE statements are understood structurally—not checked with brittle string matching.
Approvals that fit
Route sensitive work through approval workflows without turning every safe query into a ticket.
Masking & row filters
Return useful results while protecting sensitive columns and limiting which rows each role can see.
Separate auth & access
Authentication, authorization, and per-connection role access stay independent and explicit.
Searchable activity trail
Capture complete activity events in one canonical format with VictoriaLogs or Elasticsearch.
Governance in the path
Every query gets context.
Rowset evaluates identity, connection access, SQL safety, data policy, and approval state before work reaches the database. Timeouts, bounded pools, and cancellation keep the path predictable under load.
01
Authenticate the userIdentity stays separate from database credentials
verified02
Authorize the connectionRole and environment access checked independently
allowed03
Inspect and enforceAST rules, row filters, masking, and approvals applied
protected04
Record the eventSearchable activity context emitted consistently
auditedOne-container deployment
Own the control plane. Keep the data plane.
Rowset Core and Studio ship together. Persistent control data stays on your volume, saved connection credentials are encrypted, and customer databases remain external.
✓No Rust or Node.js runtime required on the server.
✓Configurable timeouts, bounded connection pools, and query cancellation.
✓AMD64 and ARM64 Linux deployment with Docker Compose.
$ mkdir rowset && cd rowset
$ curl -fsSLO https://raw.githubusercontent.com/
dbaopsio/rowset/main/compose.yml
dbaopsio/rowset/main/compose.yml
$ curl -fsSLO https://raw.githubusercontent.com/
dbaopsio/rowset/main/.env.example
dbaopsio/rowset/main/.env.example
$ mkdir scripts && curl -fsSLo scripts/install.sh
https://raw.githubusercontent.com/dbaopsio/rowset/main/scripts/install.sh
https://raw.githubusercontent.com/dbaopsio/rowset/main/scripts/install.sh
$ chmod 700 scripts/install.sh
$ ./scripts/install.sh --backend victorialogs
✓ Rowset is ready
→ Studio: http://127.0.0.1:8080
Start with control
Make production SQL access boring.
Deploy Rowset on your infrastructure and give every query a clear identity, policy decision, and activity record.