Databunker is a free, self-hosted, open-source vault for tokenizing and encrypting PII, PHI, and KYC data. See features, MIT licensing, and Pro pricing details.
Category
Databases
Pricing
Free / Open Source (with a paid Databunker Pro tier), from Free
Verified
Not yet
Last updated
July 18, 2026
Founded
2017
APIOpen SourceFreemiumSelf-Hosted
Overview
Databunker is a self-hosted, open-source data privacy vault written in Go that lets engineering teams isolate and protect sensitive personal records, including PII, PHI, and KYC data, behind a dedicated, auditable service instead of scattering it across application databases.
It is distributed under the MIT license and can be deployed via Docker Compose or a Kubernetes Helm chart, giving organizations full control over where their sensitive data physically resides.
Key Features
Databunker tokenizes entire records into UUID tokens rather than tokenizing individual fields, encrypts data at rest with AES-256 (FIPS 140-2), and secures data in transit with TLS.
It includes conditional role-based access control with field masking, tamper-evident audit logs, a passwordless self-service privacy portal for data subject requests, and support for bring-your-own-key encryption.
Pricing
The core Databunker project is free and open source under the MIT license, with no cost to self-host, modify, or embed in commercial applications.
Databunker Pro is a paid commercial edition that adds multi-tenancy and more advanced tokenization features for enterprise deployments; pricing is available on request from the vendor.
Key Features
Record-Level Tokenization — Tokenizes entire user objects into a single UUID rather than tokenizing individual fields, simplifying safe data referencing in applications.
AES-256 Encryption — Encrypts sensitive records at rest using FIPS 140-2 compliant AES-256 encryption, with TLS protecting data in transit.
Conditional Role-Based Access Control — Granular, condition-aware access policies with field-level masking to limit what each role or service can see.
Tamper-Evident Audit Logs — Detailed logs tracking every access to sensitive records, supporting compliance audits and incident investigation.
Self-Service Privacy Portal — A passwordless portal that lets data subjects view, correct, or delete their own personal data to support DSAR compliance.
Bring-Your-Own-Key Encryption — Lets organizations manage and control their own encryption keys instead of relying on vendor-held keys.
Hash-Based Search Indexing — Enables lookups against tokenized fields (e.g. email, phone) without exposing plaintext values in indexes.
Self-Hosted Deployment — Deployable via Docker Compose or Kubernetes Helm chart, keeping full data custody within the organization's own infrastructure.
Pros & Cons
Pros
Free and open source under the permissive MIT license
Self-hosted architecture keeps full custody of sensitive data and avoids adding another third-party processor
Purpose-built for PII, PHI, and KYC data rather than generic secrets management
Includes built-in DSAR self-service portal, reducing custom development for GDPR/CCPA compliance
Cons
Requires in-house engineering resources to deploy, operate, and maintain
Databunker Pro pricing is not publicly listed, requiring direct vendor contact for enterprise features
Smaller community and ecosystem compared to established commercial vault vendors
Self-hosting shifts operational security and uptime responsibility onto the adopting team
Pricing
Open Source (Community) Free N/A
Databunker Pro Custom (contact vendor) N/A
Frequently Asked Questions
Is Databunker free to use?
Yes, the core Databunker project is free and open source under the MIT license. A paid Databunker Pro tier is also available with additional enterprise features.
What kind of data does Databunker store?
Databunker is designed to store and tokenize sensitive personal records such as PII, PHI, PCI, and KYC data.
Is Databunker self-hosted?
Yes, Databunker is deployed by the organization itself, typically via Docker Compose or a Kubernetes Helm chart, so data never leaves infrastructure the organization controls.
How does Databunker protect data?
It combines AES-256 encryption at rest, TLS in transit, record-level tokenization, role-based access control with field masking, and tamper-evident audit logs.
What is Databunker Pro?
Databunker Pro is a paid, enterprise-oriented edition that adds features like multi-tenancy and more advanced tokenization on top of the free open-source core.
Who typically uses Databunker?
Backend, security, and compliance engineers at startups and regulated companies (fintech, healthtech, crypto/KYC platforms) needing GDPR, HIPAA, or KYC-compliant data storage.