HexaTier Database Security and Compliance

HexaTier is an Israeli database security startup headquartered in Bnei Brak with offices in Boston and Irvine. Founded in 2009 as GreenSQL, it originated from the GreenSQL open source database firewall project and initially delivered a commercial reimplementation of that technology. Over time, its flagship product evolved into a unified database security platform that combines traditional database security controls with sensitive data discovery, dynamic data masking, and activity monitoring across several open source and cloud database platforms.

In 2016, the company rebranded from GreenSQL to HexaTier to reflect a strategic marketing shift toward cloud-first database security and compliance, building on years of cloud database support. In December 2016, Huawei acquired HexaTier, positioning the product for distribution into larger markets and potentially improving its global presence.

The product’s core architecture is a Database Reverse Proxy deployed in front of a database to intercept and analyze all traffic between applications and the database. This enables database activity monitoring (including column-level audit logs with before/after data states), policy-based database firewalling and access control, protocol-level attack protection such as SQL injection blocking, heuristic risk scoring of suspicious queries, sensitive data discovery using quick heuristic sampling, and transparent dynamic masking implemented via query rewriting and result masking. The proxy approach avoids agents and additional infrastructure changes, and it is particularly suited to Database-as-a-Service deployments where underlying systems are not accessible.

Operationally, one gateway installation can protect multiple database instances from a centralized web console. The solution supports master/slave high availability but lacks native horizontal scaling and has limited support for enterprise DBMSs (e.g., Oracle remains on the roadmap), making it especially aligned to SMBs seeking fast, low-effort deployment for cloud migration and compliance.

• HexaTier is headquartered in Bnei Brak, Israel and has US offices in Boston, Massachusetts and Irvine, California.
• The company was established in 2009 under the name GreenSQL.
• GreenSQL originated from an open source database firewall project with the same name.
• The company rebranded from GreenSQL to HexaTier in 2016.
• The strategic focus in 2016 shifted to database security and compliance in the cloud.
• Huawei acquired HexaTier in December 2016.
• The platform is based on a Database Reverse Proxy that intercepts all network traffic between applications and a database.
• A single installation can act as a gateway protecting multiple database instances managed through a web-based console.
• Native horizontal scaling is not supported, while master/slave high availability is supported.
• The product focuses on databases such as MySQL, Amazon Aurora, and Microsoft Azure SQL, with Oracle listed on the roadmap.

• “HexaTier’s approach to this challenge is to deliver a unified, scalable, and agile solution, which can be quickly deployed on-premises, in a cloud environment or on top of a Database-as-a-Service without any changes in existing infrastructures”
• “The core technology the platform is based on is Database Reverse Proxy”
• “the reverse proxy method does not require additional hardware or software, functions completely transparently for both databases and applications and only requires minimal configuration changes to activate”
• “For certain deployment scenarios, like protecting Database as a Service instances deployed in the cloud, this approach is the only viable option”
• “It is also able to record a comprehensive audit log for each access to the data down to a column level.”
• “The database firewall allows administrators to define granular security and access policies across different context variables like user identity or group, IP address, time of the day or specific client application.”
• “a built-in heuristic engine is able to identify suspicious queries and rank them by risk scores.”
• “Queries deemed to be too risky can be blocked automatically without terminating the entire session”
• “it’s always the first and most critical step for identifying the sensitivity of data at hand and thus for designing the most appropriate security policies for its protection.”
• “The solution works in two ways: by rewriting incoming SQL queries so that the database performs masking actions itself and by applying masking rules directly on returned results.”