The relational database (Aurora PostgreSQL) is encrypted with AES-256. Access is granted via IAM-authenticated tokens with a validity period of only 15 minutes — effectively a just-in-time access mechanism.

At the application level, tenant separation is ensured by mandatory filtering by tenant ID on every query. All database queries use exclusively parameterized, type-safe methods. SQL injection attacks are thus prevented by design.

Database schema changes are managed exclusively through versioned migrations. The database validates the schema at startup but never makes autonomous changes. Production access requires special administrator permissions and is fully logged via CloudTrail.