10 open-source apps whose database can't read itself
Not demos. Real projects with their own logins and their own databases, forked and made to hold only ciphertext for the fields that matter.
Each one seals the sensitive fields before they reach the database and opens them only for a user a quorum granted the reading role. The same pattern works across Node, Ruby, PHP and Python, and every fork is off unless it's configured, so an unconfigured checkout behaves exactly like upstream.
Projects
Formbricks
Formbricks collects survey answers, and those answers are often the most sensitive thing a company holds about its customers. In this fork, answers are sealed before they reach Postgres, and reading them takes a role that a quorum of admins granted.
Twenty
A CRM is a list of people and everything a team knows about them. In this fork, the personal fields in Twenty are sealed before they reach Postgres and decrypted in the browser, so the server and its database only ever hold ciphertext.
Cal.diy
Every booking carries someone's name, phone number and the reason they're meeting. In this fork of Cal.com's scheduling platform, those fields are sealed before they reach Postgres, and each request can only open them as its own signed-in user.
Documenso
A signed document is a promise, and the database that holds it knows the parties, the terms and the signatures. In this fork of Documenso, the open source DocuSign alternative, those fields are sealed before they reach Postgres, open only for a signed-in user a quorum granted the role, and each completion is threshold-signed by the Tide network so no operator can forge it.
Medusa
A commerce database is the classic breach: it knows who your customers are, where they live and how to reach them. In this fork of Medusa, the open source Shopify alternative, that personal data is sealed before it reaches Postgres and opens again in-request only for a staff member a quorum granted the reading role.
Rocket.Chat
A chat server's most sensitive data is the message itself. In this fork of Rocket.Chat, the open source Slack alternative, a message's text is sealed before it reaches MongoDB, and opens back to plaintext only for a member a quorum granted the reading role, both when loading history and as messages arrive live.
Chatwoot
A support tool holds who your customers are and everything they told your team. In this fork of Chatwoot, the open source Zendesk alternative, a contact's name and phone and the body of every message are sealed before they reach Postgres, and open only for an agent a quorum granted the reading role. It is the first non-Node integration, proving the sealing sidecar is language-agnostic.
Firefly III
A personal finance manager knows who you pay, how to reach them and what every transaction was for. In this fork of Firefly III, those fields are sealed before they reach the database, and open only for a user a quorum granted the reading role. The numbers a budgeting app has to add up stay in the clear, so reports and charts are untouched. It is a second non-Node integration, in PHP and Laravel, further proving the sealing sidecar is language-agnostic.
Paperless-ngx
A document archive is a pile of exactly the things a breach is about: who wrote to you, what the letter said, the notes you took. In this fork of Paperless-ngx, a document's title, its full OCR text, the correspondent and the notes are sealed before they reach the database, and open only for a user a quorum granted the reading role. It is a first integration in Python and Django, further proving the sealing sidecar is language-agnostic.
OpenEMR
A medical record is the most regulated, most sensitive data most software ever holds. In this fork of OpenEMR, the widely used open source electronic health records system, a patient's name, Social Security number, address, phone and email are sealed before they reach the database, and open only for a clinician a quorum granted the reading role, even an administrator. It seals a large legacy PHP app with no ORM, showing the sidecar reaches any stack.
Adding it to something else? Join the Discord and I'll help you out.