Safety and privacy.

The guards, in order#

No single switch makes a database safe, so Plasma stacks several. From outermost to innermost:

Safe mode#

Safe mode is a confirmation level for the SQL you run from the editor, the grid commit and the actions that write on your behalf. Set the default in Settings → Security → Safe mode (the default level is Confirm dangerous statements), and override it per connection in Advanced.

• What counts as dangerous: DROP, TRUNCATE, DELETE, an UPDATE without WHERE, ALTER … DROP or RENAME, MERGE, DO blocks, CALL, COPY … FROM, INSERT … ON CONFLICT DO UPDATE and data-changing CTEs. EXPLAIN ANALYZE counts as its target statement. It is a heuristic, not a parser: a false positive only costs an extra confirmation.
• Functions with side effects (such as nextval, set_config, pg_terminate_backend, advisory locks and pg_notify) count as writes. At the Read-only level, a SELECT that calls a function Plasma cannot vouch for asks first, because it might write.
• The dialog is titled Run this statement? and names the connection; it points to the connection’s Advanced settings to change the level. For a grid commit it reads Commit changes?.
• Statements that a refused level blocks come back with a message saying Safe mode is read-only for the connection.

The Prod gate#

Tag a connection Prod (Connections) and it gets a stricter set of rules on top of Safe mode, whatever the level:

• A destructive statement or a grid commit asks first. The dialog reads Run destructive query on production? (or Commit changes to production?), reminds you to verify your WHERE clause, and its confirm button is Run anyway (Commit).
• The connection capsule in the top bar turns red so you cannot forget where you are.
• Read-only is suggested when you pick the tag.
• Safe Run is on for writes by default; Redis CLI writes and OpenSearch writes ask; deleting Redis keys by pattern needs the count typed in.
• The audit log records every statement on it.
• The AI assistant sends no schema until you opt that connection in; unverified TLS is not allowed.

A ClickHouse mutation (ALTER TABLE … UPDATE and similar) gets its own confirmation, Run an asynchronous mutation?, because it cannot be rolled back.

Read-only, enforced where the engine allows#

The Read-only switch is not just a greyed-out button. The main process classifies every request and refuses writes (including grid commits, DDL, imports, restores, Redis writes, OpenSearch index and document changes, pg_notify and Safe Run) before they reach a driver, and the engines add their own enforcement:

Other places Plasma stops to ask#

• Closing a tab with unsaved SQL: Close “…” without saving?; with staged edits, Discard N changes?
• Switching or disconnecting with staged edits: Uncommitted edits, with Cancel, Discard and Commit.
• Quitting the window with unsaved work: Close Plasma and discard your work?, with Cancel and Discard and close.
• Dropping and truncating objects show the exact statement and a CASCADE option first.
• Restart to update lists what the restart would lose.

Audit log#

Open History and switch to Audit. Plasma appends a row for every statement run on a Prod-tagged connection; turn on Settings → Security → Record every connection, not only Prod to include all of them. Each row has the time, connection, database user, source, outcome, row count, duration and the statement. The source says where the statement came from: Editor, Grid commit, Safe Run, Structure, Import, AI suggestion, NOTIFY or MCP tool.

• Redacted. Statements and error text go through the same redactor as the query history: PASSWORD '…' literals and password= values are masked, and error text drops the values it quotes.
• Append-only and chained. The table refuses updates and deletes, and each row stores a SHA-256 hash of its fields plus the previous row’s hash. Verify log integrity replays the chain and tells you if a row in the middle was edited or removed. This is tamper evidence, not tamper proofing: someone with access to the database file could rewrite the whole chain.
• Retention. Entries older than Audit retention (30, 90, 180, 365 or 1,095 days; default 90) are removed, and the remaining log still verifies.
• Filter and export. Search statements, users and errors; filter by connection, outcome and date range; export CSV or JSON.

Masking#

Presentation mode masks sensitive values on screen, in the clipboard and in the AI context; the MCP server always masks. See Presentation mode and masking. Masking is display only: stored data and the values used for edits do not change.

Where secrets are stored#

• Database passwords, SSH passwords, keys and passphrases, OpenSearch credentials and the AI API key are encrypted with the operating system’s secret store through Electron’s safeStorage (macOS Keychain, Windows Credential Vault, or libsecret / GNOME Keyring / KWallet on Linux). The ciphertext sits in Plasma’s local database; the interface process never receives a saved password back.
• If the system has no usable secret store, Plasma refuses to save secrets. On Linux with no keyring it asks at startup: Don’t store secrets or Store with weak protection, the second meaning a fixed fallback key that every program on the computer knows. Choosing weak protection is remembered; declining is asked again at the next launch. Installing and unlocking a keyring, then restarting, is the better answer.
• Team workspaces never hold passwords: a profile that contains one is skipped. The password you type for a workspace connection goes to your keychain.
• The MCP token is the exception: the stdio bridge has to read it, so it lives in a file in Plasma’s folder that only your user can read (mode 0600 where the system has file modes).
• Logs and the support bundle remove secrets and never include query results, SQL you wrote, or row data.

What leaves your machine, and when#

Plasma has no account system and no usage analytics or crash-report upload. Beyond the databases you connect to, it talks to the network in these cases only:

The app window can only show the app itself, denies browser permission prompts (camera, location, notifications and so on) and sends external links to your operating system’s browser.