nabla — the gradient operator. The layer that acts on the substrate.
Silo-grade isolation at pool-model economics.
NablaDB is a per-tenant isolation layer for vector search. Each tenant's vectors live in their own cryptographically keyed coordinate frame. A query with the wrong tenant's key returns noise. Shared infrastructure, provable separation.
Why filters are not a boundary.
The pool model leaks by default
Multi-tenant RAG shares one index across customers and separates them with a tenant_id filter. One missed check is a silent cross-tenant leak. Independent 2026 research measured ungated retrieval leaking cross-tenant data in 98 to 100% of probes. Under GDPR, a cross-tenant leak is a reportable breach.
The silo model doesn't scale
The strong answer is an index or an enclave per tenant. Cost grows with every customer. One enclave per tenant is the wall the market is hitting.
NablaDB is the third option: cryptographic tenant separation inside shared infrastructure.
Three properties, working together.
Keyed coordinate frames.
Every tenant’s vectors are rotated into a private coordinate frame derived from their key before they touch the index. Distances are preserved, so search still works. A wrong-key query returns noise, not a neighbour.
Authenticated at rest.
Stored vectors are encrypted and authenticated (AES-GCM), bound to their tenant. A wrong-tenant read fails authentication and returns nothing. Deletion is cryptographic: drop the key and the data is unrecoverable.
Zero-disclosure isolation audit.
A verifier can continuously confirm that tenant isolation held, without reading tenant content. Isolation you can demonstrate to an auditor, not just assert.
Isolation properties are empirically validated and configuration-dependent. Full threat model and caveats ship with the product. We state what each tier does and does not protect against.
One isolation layer. Your choice of engine.
Layer over your existing store
Runs client-side over the vector database you already operate. Rotate and authenticate before vectors leave your process. No rip-and-replace.
NablaDB on open-source engines
Managed or self-hosted NablaDB with a proven open-source engine underneath. Qdrant-backed for performance-led stacks. A Postgres/pgvector flavor for estates that live in Postgres. Chroma for local development. We build the isolation envelope; the engine stays best-in-class open source.
Confidential computing tier
Inside the TEE you already run. The enclave holds the host boundary; NablaDB holds the tenant boundary inside it. Many isolated tenants per enclave instead of one enclave per tenant.
The lane.
Tenant filters
Namespaces, tenant_id, row-level security. Cheap and standard. Enforcement-based: one missed check leaks silently, and nothing proves it held.
NablaDB
Cryptographic coordinate isolation per tenant. Wrong key returns noise by construction. Runs on shared commodity infrastructure and composes with enclaves. Isolation you can audit.
One enclave per tenant
Hardware-attested and strong. A certified-hardware dependency and a per-tenant cost wall. Doesn't scale with customer count.
We don't compete with your vector database or your enclave. We're the tenant boundary both of them are missing.
Built on the Cittela isolation primitive. 16 filed UK provisional patent applications.
Published research and machine-checked proofs: Zenodo 10.5281/zenodo.20727024 · 10.5281/zenodo.20729953
The same primitive isolates AI serving at isovert.com.