nabla — the gradient operator. The layer that acts on the substrate.
Silo-grade isolation at pool-model economics.
NablaDB is a per-tenant isolation layer for vector search. Each tenant's vectors live in their own cryptographically keyed coordinate frame. A query with the wrong tenant's key returns noise. Shared infrastructure, provable separation.
Why filters are not a boundary.
The pool model leaks by default
Multi-tenant RAG shares one index across customers and separates them with a tenant_id filter. One missed check is a silent cross-tenant leak. Published 2026 research has measured ungated retrieval leaking cross-tenant data in the large majority of probes. Under GDPR, a cross-tenant leak is a reportable breach.
The silo model doesn't scale
The strong answer is an index or an enclave per tenant. Cost grows with every customer. One enclave per tenant is the wall the market is hitting.
NablaDB is the third option: cryptographic tenant separation inside shared infrastructure.
Four properties, working together.
Keyed coordinate frames.
Every tenant’s vectors are rotated into a private coordinate frame derived from their key before they touch the index. Distances are preserved, so search still works. Without the right key the stored payload is inert.
Authenticated at rest.
Stored vectors are encrypted and authenticated (AES-GCM), bound to their tenant. A wrong-tenant read fails authentication and returns nothing. Deletion is cryptographic: drop the key and the data becomes inaccessible.
Isolation you can test, not just assert.
Wrong-key reads fail authentication by construction, not by policy check. Under blind adversarial testing — the test script provably absent from the repository when the system was built — cross-principal decryption succeeded in 0 of 120 attempts across three attack families: wrong subject, wrong tenant, and substituted authentication context.
Scope: smoke-scale, single node. A larger sweep is planned and not yet run.
Erase one person, not one tenant.
Each subject’s vectors sit under their own key in a per-subject key tree. Destroying that key makes their data cryptographically inaccessible in one operation, backups included, and issues a certificate stating exactly what was covered. Retrieval quality is unchanged: recall measured at parity with an unkeyed baseline.
Scope: vector and retrieval state. Serving and agent memory sit on the same key tree and are not yet covered by the certificate.
Isolation properties are empirically validated and configuration-dependent. Full threat model and caveats ship with the product. We state what each tier does and does not protect against.
Rotation-key strength is screened by the operator, who holds the data. A customer cannot self-screen: key geometry alone does not predict which keys isolate weakly.
One isolation layer. Your choice of engine.
Layer over your existing store
Runs client-side over the vector database you already operate. Rotate and authenticate before vectors leave your process. No rip-and-replace.
NablaDB on open-source engines
Managed or self-hosted NablaDB with a proven open-source engine underneath. Qdrant-backed for performance-led stacks. A Postgres/pgvector flavor for estates that live in Postgres. Chroma for local development. We build the isolation envelope; the engine stays best-in-class open source.
Confidential computing tier
Inside the TEE you already run. The enclave holds the host boundary; NablaDB holds the tenant boundary inside it. Many isolated tenants per enclave instead of one enclave per tenant.
The lane.
Tenant filters
Namespaces, tenant_id, row-level security. Cheap and standard. Enforcement-based: one missed check leaks silently, and nothing proves it held.
NablaDB
Cryptographic coordinate isolation per tenant. Wrong-key reads fail authentication by construction. Runs on shared commodity infrastructure and composes with enclaves. Isolation you can test, not enforcement you have to trust.
One enclave per tenant
Hardware-attested and strong. A certified-hardware dependency and a per-tenant cost wall. Doesn't scale with customer count.
We don't compete with your vector database or your enclave. We're the tenant boundary both of them are missing.
Built on the Cittela isolation primitive. 18 filed UK provisional patent applications.
Published research and machine-checked proofs: The Isometry Tax (at-rest leakage in rotation-isolated vector search) 10.5281/zenodo.20778536 · rekeyable proofs 10.5281/zenodo.22117648 · isolation paper 10.5281/zenodo.20727023
The same primitive isolates AI serving at isovert.com and erases individual subjects at deletable.org.
[ GET STARTED ]
Give every tenant its own coordinate frame.
Shared infrastructure, provable separation. Talk to us about running NablaDB over the vector store you already operate.