# cossacklabs/acra: Database Encryption, Search, and Intrusion Detection

> Acra is a Go-based database security suite for applications that need field-level encryption, searchable encrypted data, SQL filtering, masking, tokenization, and intrusion alerts. Its Community Edition covers several core controls, while key rotation without data re-encryption, KMS integration, and protected audit logging belong to Acra Enterprise.

**cossacklabs/acra** — Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

- Repository: https://github.com/cossacklabs/acra
- Website: https://www.cossacklabs.com/acra/
- Stars: 1,494 · Forks: 140
- Language: Go
- License: Apache-2.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/cossacklabs-acra

## Acra's Boundary Between Application and Database

Acra addresses the point where an application writes sensitive records into SQL or NoSQL storage. Its intended users are web, server-side, mobile, IoT, and high-load applications that handle personal or otherwise sensitive data, including healthcare, finance, SaaS, and critical infrastructure systems. The repository describes applications with more than 1,000 users as a typical case, but that figure is an example rather than a documented product limit.

The central design choice is selective encryption at the field level. An application can identify the database columns, cells, or JSON values that need protection, encrypt them before storage, and decrypt them inside a compartmentalized Acra environment. Encryption can happen on the client side or on the Acra side. The latter is described as transparent encryption, which is useful when changing every application write path would be expensive.

This approach does not encrypt an entire database by default. The administrator selects what must be protected, balancing security against the performance cost of encryption. That makes Acra suitable for heterogeneous records in which only a subset is sensitive, but it also means correct field selection is an application and schema responsibility. Encrypting the wrong columns can break queries, while leaving a sensitive column outside the configured set defeats that control.

## AcraBlocks, AcraStructs, and the Protected Data Path

Acra uses two cryptographic envelopes. The README names AcraBlocks and AcraStructs. AcraBlocks are symmetric containers and are the recommended default for Acra-side encryption. AcraStructs are asymmetric containers intended for client-side encryption. Both wrap protected field data before it reaches a database or file store.

The intended flow starts as early as the client when client-side protection is selected. The client transforms the value into an AcraStruct, sends the protected representation to the service or database path, and relies on Acra-side components to perform authorized operations. With proxy-side encryption, the application can continue addressing its storage service while Acra intercepts the relevant traffic and protects selected fields. Searchable encryption adds a separate representation based on AES-GCM and a blind index, allowing exact queries without returning the original value for comparison.

Acra also separates security controls from storage. Masking and anonymization can remove or mask sensitive output, while tokenization substitutes a token and associates it with the original when required. Basic key tools cover generation, export, backup, and rotation. The repository includes Go packages for crypto, keystore, networking, SQL parsing, masking, pseudonymization, poison records, and wrappers, which is consistent with a suite assembled from separate protection and proxy components rather than a single SQL extension.

## Searchable Encryption and SQL Query Controls

Encrypted columns normally create a database problem: a query cannot compare ciphertext with a plaintext search term. Acra's searchable encryption is narrowly defined for exact queries and uses AES-GCM with a blind index. The blind index is the database-searchable representation, while encryption protects the protected value itself.

This is not a general encrypted query engine. The README does not describe range scans, fuzzy matching, arbitrary predicates, or searches over partially masked values. An application that needs to find records by age range, free-text fragments, or complex SQL expressions must verify a supported Acra control rather than assuming that field encryption preserves every query shape.

The SQL firewall is a separate control. It is described as blocking suspicious SQL queries, and the repository contains `sqlparser/` plus the `pg_query_go/v5` dependency. That suggests query inspection is implemented as part of Acra's SQL-facing components. The firewall can therefore reduce exposure to suspicious query patterns, but it does not replace authorization checks in the application or database account design. A SQL parser also has to understand the syntax accepted by the database and client driver in use. The README does not document a complete compatibility matrix, supported SQL dialect list, or behavior for every malformed query.

## Poison Records and Intrusion Detection Boundaries

Acra includes intrusion detection through poison records, also called honey tokens. The README says these records warn operators about suspicious behavior. The repository has a `poison/` package, and the architecture places detection alongside encrypted data and access controls. This is useful when an unauthorized actor reaches a datastore and begins querying or copying protected material: an unexpected interaction with a specially configured record can produce a signal rather than remaining an ordinary database access.

This mechanism has a narrow purpose. It detects certain suspicious activity, but it does not claim that every database read, stolen credential use, or application compromise will generate a poison-record event. Detection coverage depends on deployment, data placement, query routing, and whether the relevant Acra component remains reachable. The README also does not specify an alert format, notification destination, retention policy, or a complete incident-response workflow.

That makes poison records useful as one signal in a database security plan, not as a complete intrusion detection system. Operators still need to determine where logs or events are delivered and how they are investigated. Acra Enterprise is listed as including cryptographically protected audit logging, so teams that require a documented protected audit trail should verify whether that feature is part of their licensed edition rather than assuming it belongs to the Community Edition.

## Installing Acra and Performing a First Protected Use

The README points installation readers to the project's installation and launch documentation and to the official documentation and tutorials. It also links the GitHub releases page and lists Ubuntu, Debian, and CentOS as server platforms. The repository does not include a complete installation command, package name, service unit, configuration file, or launch command, so an executable installation block would require inventing details.

The repository does confirm that the project is a Go module named `github.com/cossacklabs/acra` and that its source is organized around commands and client or proxy components. The `examples/` directory contains examples for Android Java, C++, Go, Node.js, Objective-C, PHP, Python, Ruby, and Swift. These examples are the relevant starting points for understanding how an application integrates with Acra, but the README does not show their exact invocation commands.

A first real use should therefore begin in the linked installation tutorial and one matching example directory. Confirm the Acra process or service, database connection path, selected encrypted fields, key configuration, and client SDK before issuing application traffic. The reader should see ciphertext in the protected database field and the application receive the decrypted value only through the authorized Acra path. The documentation should also show how to configure an exact search field with its blind index and how to confirm that an unencrypted or unmasked field was not accidentally changed.

## Community Edition, Apache-2.0, and Maintenance Boundaries

The repository identifies Acra Community Edition as free for commercial and non-commercial use and lists the project license as Apache-2.0. That license covers the repository's stated licensing terms, but it does not remove operational obligations around dependencies, client libraries, external databases, KMS systems, or separately purchased Enterprise features. Organizations using Acra should review the license files and dependency notices for their actual distribution and deployment.

The feature table marks key rotation without data re-encryption, KMS support, and cryptographically protected audit logging as Acra Enterprise capabilities. Key generation, export, backup, and rotation are described as basic key-management tools, which means those two uses of rotation should not be conflated. One may refer to ordinary key material operations, while the Enterprise item is specifically rotation without rewriting protected data.

The repository is not archived. Its last push was on 2026-04-23, while the most recent listed release is 0.96.0 from 2024-09-09. That release gap and the difference between repository activity and release cadence are reasons to review the changelog, compatibility notes, and upgrade instructions before adopting a version. The repository has a `CHANGELOG.md`, `CHANGELOG_DEV.md`, `CONTRIBUTING.md`, tests, Docker files, and platform wrappers, but the README does not state a supported upgrade path or a service migration procedure. Key configuration, data formats, and wrapper compatibility should be checked before changing a deployed version.

## Conclusion

Adopt Acra when an application needs field-level protection that remains useful after database storage is compromised, especially if it can integrate SDK-based or transparent proxy encryption. Do not adopt it as a direct substitute for full database authorization, query validation everywhere, or an enterprise audit system unless the required controls are verified in your edition. Verify first which fields will be encrypted, where keys live, whether your SQL dialect is supported, how searchable encryption affects queries, and whether required key-management features are present in Acra Community Edition.

## FAQ

### What problem does Acra solve?

Acra is a database security suite for protecting sensitive fields in applications that use SQL or NoSQL datastores. It provides field-level encryption, searchable encryption, masking, tokenization, key tools, SQL filtering, and intrusion detection mechanisms.

### Does Acra support client-side and transparent encryption?

Yes. The README describes client-side encryption using AcraStructs and proxy-side or transparent encryption on the Acra side. AcraBlocks are described as the default symmetric containers for Acra-side encryption.

### Can Acra search encrypted data?

Acra supports exact searches through encrypted data using AES-GCM and a blind index. The README does not claim support for range queries, fuzzy matching, or arbitrary encrypted SQL predicates.

### Which Acra features require Acra Enterprise?

The README marks key rotation without data re-encryption, KMS support, and cryptographically protected audit logging as Acra Enterprise features. The repository is also identified as Acra Community Edition.

### How do I install Acra?

The README links to the official installation and launch section and to the documentation and tutorials. It does not provide a complete install command, so the exact package, service, and launch steps must be taken from those project documents.

## Sources

- [cossacklabs/acra on GitHub](https://github.com/cossacklabs/acra)
- [License: Apache-2.0](https://github.com/cossacklabs/acra/blob/master/LICENSE)
- [Project website](https://www.cossacklabs.com/acra/)
- [README](https://github.com/cossacklabs/acra/blob/master/README.md)
- [Releases](https://github.com/cossacklabs/acra/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/cossacklabs-acra