Engines
Each ShrouDB feature is an engine inside the server. Enable the ones you need in moat.toml. They share the same encrypted storage, access tokens, and audit log, so data from one is protected the same way as data from another.
Cipher
Encrypt customer data before it reaches your database
Encryption and signing. Your app never holds a key.
How it works →Sigil
Add sign-up, login, and sessions
User accounts, passwords, sessions, and JWTs.
How it works →Keep
Get database passwords and API keys out of .env files
Versioned, encrypted secrets with path-based access.
How it works →Veil
Search data you've encrypted
Exact, prefix, contains, and fuzzy search over encrypted fields.
How it works →Stash
Store user files you can permanently delete
Encrypted file storage on S3 with cryptographic deletion.
How it works →Chronicle
Answer “who accessed this, and when?”
A tamper-evident audit log of every operation.
How it works →Sentry
Decide who is allowed to do what
Policy-based authorization with signed decisions.
How it works →Forge
Issue TLS certificates for your internal services
An internal certificate authority.
How it works →Courier
Notify people whose contact details you store encrypted
Delivery to encrypted recipients.
How it works →