Skip to content
SPECIFICTION
Get listed

Acra

cossacklabs.com

From $833.33/mo Free plan Open source macOSLinuxiOSAndroidAPISelf-hosted
Visit cossacklabs.com
Spec score 9.5 #1 of 23 in Cloud Encryption Software

What it is

Acra protects sensitive data in SQL and NoSQL databases, web applications and backend applications. It offers field-level and searchable encryption, tokenization and data masking. Teams can deploy it as a transparent SQL proxy, an HTTP/gRPC encryption API or client-side SDKs. AcraServer supports PostgreSQL and MySQL wire protocols, including MySQL 5.7+, PostgreSQL 9.4+ and MariaDB 10.3; listed NoSQL and KV stores include MongoDB, Redis, Cassandra and TimescaleDB. Key-management integrations include Amazon KMS, Google Cloud KMS, HashiCorp Vault, Keywhiz and HSMs. Acra can detect requests for planted poison records or honeytokens, raise alarms and halt decryption. It provides security logging for SIEM/SOC analytics and a crypto-signed audit log. Server components run on Linux, with Docker and Kubernetes-compatible images documented; the maker describes Acra as cloud-agnostic and actively supported on Google Cloud Platform, AWS and DigitalOcean. Windows clients can connect to Acra on Linux, but server components should not run on Windows. Community Edition is free forever for non-profit and business use; Enterprise Edition starts at $10,000 a year, with price dependent on deployments and requested features.

Spec sheet

What it does
Acra is a database security suite that protects sensitive fields and records throughout distributed applications’ data lifecycles.Read 15 Oct 2026 · docs.cossacklabs.com
Purpose
Acra protects sensitive data in SQL and NoSQL databases, web applications, and backend applications.Read 30 Sep 2026 · cossacklabs.com
Intended users
The maker describes Community Edition as best for prototyping and small-scale projects and Enterprise Edition as suited to large-scale and enterprise deployments.Read 30 Sep 2026 · cossacklabs.com
Deployment
Server components are distributed as Linux packages, Docker images and source builds, with Kubernetes-compatible images.Read 15 Oct 2026 · docs.cossacklabs.com
API
AcraTranslator exposes HTTP and gRPC APIs for encryption, searchable encryption, tokenization and related operations.Read 15 Oct 2026 · github.com
Support
The maker offers multiple support tiers and describes integration assistance, solution support, and 24/7 solution support among its offerings.Read 30 Sep 2026 · cossacklabs.com
Headquarters
London, United KingdomRead 28 Sep 2026 · cossacklabs.com
Founded
2014Read 28 Sep 2026 · cossacklabs.com
Application-level encryption
The product encrypts selected database cells or fields, including with AES-256-GCM cryptographic containers.Read 15 Oct 2026 · cossacklabs.com
Audit and SIEM
Acra provides security logging for SIEM/SOC analytics and a crypto-signed audit log covering access and security events.Read 30 Sep 2026 · cossacklabs.com
Audit logging
Enterprise editions provide cryptographically signed audit logs covering access and security events.Read 15 Oct 2026 · cossacklabs.com
Changelog event
Version 0.90.0 dated November 5, 2021 added open-source documentation, searchable encryption, masking, tokenization, AcraBlocks, Vault integration and an OpenAPI/Swagger HTTP API.Read 15 Oct 2026 · github.com
Cloud hosting
Acra is described as cloud-agnostic and actively tested and supported on Google Cloud Platform, AWS, and DigitalOcean.Read 30 Sep 2026 · docs.cossacklabs.com
Community Edition limitation
Acra Community Edition does not support MySQL Protocol X.Read 30 Sep 2026 · docs.cossacklabs.com
Company founded and size
LinkedIn lists Cossack Labs as founded in 2014 with 11–50 employees.Read 15 Oct 2026 · uk.linkedin.com
Company funding
The reviewed Crunchbase profile describes products and locations but does not state a funding amount.Read 15 Oct 2026 · crunchbase.com
Company headquarters
Cossack Labs is headquartered in London, United Kingdom, with research and development in Kyiv, Ukraine.Read 15 Oct 2026 · crunchbase.com
Company legal name
The GitHub project identifies the business entity as Cossack Labs Limited.Read 15 Oct 2026 · github.com
Database support
AcraServer supports PostgreSQL and MySQL wire protocols, including MySQL 5.7+, PostgreSQL 9.4+, and MariaDB 10.3.Read 30 Sep 2026 · docs.cossacklabs.com
Databases
Acra is designed for SQL and NoSQL data stores and can operate as a database proxy or API service.Read 15 Oct 2026 · github.com
Deployment forms
Acra can run as a transparent SQL proxy, an HTTP/gRPC encryption API, or client-side SDKs.Read 30 Sep 2026 · cossacklabs.com
Deployment platforms
Server components run on Linux distributions including CentOS, RHEL, Debian, and Ubuntu, and the maker documents Docker and Kubernetes-compatible images.Read 30 Sep 2026 · docs.cossacklabs.com
Documentation depth
The documentation covers use cases, architecture, security controls, cryptography, scaling, load balancing, configuration, installation and tutorials.Read 15 Oct 2026 · github.com
Encryption options
Acra offers field-level encryption, searchable encryption, tokenization, and data masking.Read 30 Sep 2026 · cossacklabs.com
Evaluation
The maker offers a free evaluation playground running Acra Enterprise Edition for selected popular use cases.Read 30 Sep 2026 · cossacklabs.com
Intrusion detection
Acra includes poison records and other controls for detecting unauthorized database behavior.Read 15 Oct 2026 · cossacklabs.com
Key management
Key utilities support generation, export, backup, rollback and enterprise key rotation without re-encrypting data.Read 15 Oct 2026 · cossacklabs.com
Key management integrations
The maker lists Amazon KMS, Google Cloud KMS, HashiCorp Vault, Keywhiz, and HSMs for key storage and management integration.Read 30 Sep 2026 · cossacklabs.com
KMS integrations
Documented integrations include AWS KMS, Google Cloud KMS, HashiCorp Vault, Keywhiz and HSMs.Read 15 Oct 2026 · docs.cossacklabs.com
Latest documented release
The documentation identifies Acra Community Edition and Enterprise Edition version 0.90.0 as the latest release.Read 15 Oct 2026 · docs.cossacklabs.com
Licence
Acra Community Edition is open source under the Apache 2.0 licence; Enterprise Edition uses proprietary licences.Read 15 Oct 2026 · docs.cossacklabs.com
Limit: community and cost
G2 reviewers cite a small user community and enterprise pricing that can be expensive for small organizations.Read 15 Oct 2026 · g2.com
Limit: setup complexity
G2 reviewers report that service-side setup can be difficult, especially for people unfamiliar with cryptography.Read 15 Oct 2026 · g2.com
Masking
Acra can partially or fully mask sensitive values and transparently demask them for authorized reads.Read 15 Oct 2026 · cossacklabs.com
NoSQL integrations
The maker lists MongoDB, Redis, Cassandra, and TimescaleDB among supported NoSQL/KV data stores.Read 30 Sep 2026 · docs.cossacklabs.com
Praise: Gartner review
A Gartner review headline highlights field-level encryption and data masking as strengths while acknowledging setup complications.Read 15 Oct 2026 · gartner.com
Praise: security and usability
G2 reviewers repeatedly praise database protection, open-source availability, ease of use, broad integration and scalability.Read 15 Oct 2026 · g2.com
Rating on G2
4.4 out of 5 from 14 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.4 out of 5 from 8 reviewsRead 15 Oct 2026 · gartner.com
SDKs
Client SDKs include AcraWriter, AcraReader and an AcraTranslator SDK for Ruby, Python, Go, C++, Node.js, PHP, Swift/Objective-C, Java and Kotlin.Read 15 Oct 2026 · github.com
Searchable encryption
Acra supports searching encrypted fields, including prefix and suffix searches in its extended enterprise capability.Read 15 Oct 2026 · cossacklabs.com
Security testing
Cossack Labs states that Acra uses static and memory analysis plus unit, integration and end-to-end security tests.Read 15 Oct 2026 · docs.cossacklabs.com
Self-hosting
Acra runs in customer infrastructure through packages, Docker, Kubernetes or builds from source.Read 15 Oct 2026 · docs.cossacklabs.com
SQL firewall
AcraCensor checks database queries against configured rules and applies defined reactions.Read 15 Oct 2026 · cossacklabs.com
System requirements
Server builds require a supported stable Go compiler and Themis libraries; Windows is not supported for source builds.Read 15 Oct 2026 · docs.cossacklabs.com
TLS requirement
All Acra components require TLS 1.2 or newer and reject lower versions.Read 15 Oct 2026 · docs.cossacklabs.com
Tokenization
The system substitutes sensitive values with tokens and can detokenize them when required.Read 15 Oct 2026 · cossacklabs.com
Windows limitation
The maker says server-side Acra components should not run on Windows as the host operating system; Windows clients can connect to Acra on a Linux server.Read 30 Sep 2026 · docs.cossacklabs.com

Plans and prices

Acra Community Edition Free free forever core encryption and masking · SQL request firewall · basic intrusion detection · single configuration policy · limited platform, integration and database support Read 15 Oct 2026 · cossacklabs.com
Acra Enterprise Edition $10,000 a year starting at $10000 annually all Acra features and controls · support tiers · DevOps/SRE tooling · policy management · deployment assistance Read 15 Oct 2026 · cossacklabs.com
Acra bespoke solution Priced on request case-by-case custom masks and protocols · custom behavior · use-case features · engineering and architecture support Read 15 Oct 2026 · cossacklabs.com

Every Acra plan and price →

Strong points and limits

Strong points

  • Offers field-level and searchable encryption.
  • Supports multiple SQL and NoSQL data stores.
  • Integrates with external key-management services.
  • Can detect planted poison records or honeytokens.
  • Enterprise Edition includes policy management.

Limits

  • Server components should not run on Windows.
  • Community Edition does not support MySQL Protocol X.
  • Enterprise Edition starts at $10,000 a year.

Who it suits

Community Edition is described as suited to prototyping and small-scale projects, while Enterprise Edition is intended for large-scale and enterprise deployments. Teams using Windows can connect as clients, but the server must run on Linux.

Acra in depth

Read the full write-up

Acra is a data-protection platform for sensitive information in databases and applications. It suits development and security teams that need encryption near their data without giving up deployment control. Its broad integration choices are useful, but the full policy and support package is aimed at organizations prepared for an enterprise budget.

Overview

Acra protects sensitive data in SQL and NoSQL databases, web applications, and backend applications. It can operate as a transparent SQL proxy, provide encryption through HTTP or gRPC, or integrate through client-side SDKs. That lets teams fit protection to an existing architecture rather than redesigning every application around one interface.

The platform is cloud-agnostic and supports hybrid deployment. Server components run on CentOS, RHEL, Debian, and Ubuntu, with Docker and Kubernetes-compatible images for containerized operations. It is actively tested and supported on Google Cloud Platform, AWS, and DigitalOcean. Windows is suitable for client connections, not for hosting the server-side Acra components, which should run on Linux.

Key features

Protection can be applied at field level or through searchable encryption, tokenization, and data masking. Field-level encryption limits exposure of selected values; searchable encryption preserves the ability to query protected data; tokenization and masking reduce what applications and operators see in normal workflows. AcraServer supports PostgreSQL and MySQL wire protocols, including PostgreSQL 9.4+, MySQL 5.7+, and MariaDB 10.3. The Community Edition excludes MySQL Protocol X, a significant constraint for deployments that depend on that protocol.

Acra also connects with MongoDB, Redis, Cassandra, and TimescaleDB among NoSQL and key-value stores. Key storage and management can integrate with Amazon KMS, Google Cloud KMS, HashiCorp Vault, Keywhiz, and hardware security modules. Automated key rotation and mixed customer key control support organizations that need to retain some control while using external key-management services.

Intrusion controls go beyond encryption. Acra can recognize requests involving planted poison records or honeytokens, raise a security alarm, and stop decryption. Security logging supports SIEM and SOC analysis, while a cryptographically signed audit log records access and security events. These controls make the platform more relevant to monitored production environments than to encryption-only projects.

Pricing

Acra Community Edition

The Community Edition costs nothing and is free forever for non-profit and business use. It includes encryption and masking, an SQL request firewall, basic intrusion detection, and a single configuration policy. The combination suits prototyping and small-scale projects, but one policy limits teams that need differentiated controls across applications or environments, and MySQL Protocol X is unavailable.

Acra Enterprise Edition

Enterprise starts at $10,000 a year, billed starting at $10000 annually. Pricing depends on the number of deployments and the features requested. It includes all Acra features and controls, policy management, DevOps and SRE tooling, and multiple support tiers. This is the practical choice for large-scale or enterprise deployments where operational assistance and centralized policy control justify a substantial recurring commitment.

Acra bespoke solution

Custom pricing applies to a bespoke solution, with cost varying by included services. It can cover customized masks and protocols, customized behavior, use-case-specific features, and engineering and architecture support. That route fits unusual requirements that the standard editions cannot address, but it is not a predictable self-service purchase.

A free evaluation playground runs Acra Enterprise Edition for selected popular use cases, giving prospective teams a way to assess enterprise capabilities before committing.

Platforms

Acra supports Android, iOS, Linux, API integrations, and self-hosted deployment. Linux is the server foundation, with container images for Docker and Kubernetes. Windows clients can connect to a Linux-hosted Acra service, but Windows should not host the server components.

Who it's for

Community Edition is a sensible starting point for developers prototyping protection or running smaller projects that can work within one policy and without MySQL Protocol X. Enterprise is better for organizations operating many deployments, requiring policy management, SIEM-ready auditing, intrusion response, and support tiers. Teams with unusual protocols or architecture needs should consider the bespoke option and its engineering support.

Pros and cons

Pros

Multiple integration forms—SQL proxy, HTTP/gRPC API, and SDKs—fit different application architectures.

Encryption, tokenization, masking, searchable protection, key-management integrations, and automated rotation cover varied data-governance needs.

Poison-record detection, decryption halting, SIEM logging, and signed audit trails add operational security controls.

Cloud-agnostic, hybrid deployment with Linux, Docker, and Kubernetes support avoids dependence on one hosting environment.

The Community Edition is free forever for both non-profit and business use.

Cons

The free edition has one configuration policy and no MySQL Protocol X, which can block otherwise suitable deployments.

Enterprise begins at $10,000 a year and rises with deployment count and requested features.

Server hosting requires Linux; Windows is limited to client connectivity.

Advanced support and operational tooling are tied to the Enterprise purchase or a bespoke engagement.

Alternatives

Choose Cryptomator instead when you want an open-source, freemium encryption tool spanning Android, iOS, Linux, macOS, self-hosted, web, and Windows, with a free trial.

MySQL is the better choice when the primary need is a freemium database with SQL and NoSQL applications, replication, high availability components, and broad connector support.

Consider Thales CipherTrust Data Security Platform for a freemium platform with a free Community Edition, CipherTrust Manager, and connector licenses for data protection.

Cosmian Data Protection Suite suits teams seeking a paid, trial-enabled suite with per-CPU KMS pricing, included connectors, and any number of servers.

Pick Evervault when a hosted API-focused platform fits better and usage is under 25K transactions per month at its $995 a month Platform plan, plus usage.

Skyflow is a custom-priced alternative whose cost depends on platform fees, data subjects, localization regions, and feature requirements. Entrust Certificate Manager is a paid certificate-management product with custom pricing. PK Protect is another paid option for Linux, macOS, self-hosted, and Windows deployments.

For a wider category view, see Cloud Encryption Software.

Verdict

Acra is a strong fit for teams that need database- and application-level protection, flexible deployment, and security monitoring in one platform. Choose it when proxy, API, or SDK integration and cloud-independent hosting matter; look elsewhere if you need Windows-hosted servers, MySQL Protocol X in a free edition, or a lower-cost path to enterprise policy management and support.

Verdict

Acra provides several deployment forms and data-protection controls for application and database systems. The Community Edition has a stated MySQL Protocol X limitation; Enterprise pricing starts at $10,000 a year and depends on deployment count and requested features.

Where Specifiction places it

Alternatives to AcraAll alternatives →