Bring Your Own PostgreSQL (BYOD)
Keep your consent records in a PostgreSQL database you control. You own backups and database-level encryption; requests are still processed by the HashEntry platform.
BYOD Architectural Model
The HashEntry application layer receives and processes each consent request and writes the consent record to your PostgreSQL. Data therefore transits the platform; queues, logs and platform metadata stay on the platform, and signature files are stored encrypted on platform storage unless configured otherwise.
HashEntry Application Layer (encrypted connection)
- • API & SDK endpoints (requests transit the platform)
- • Dynamic connection routing by organization token
- • SHA-256 canonical hashing engine
- • Queues, logs and signature files on the platform
Customer PostgreSQL Server (Your Infrastructure)
- • consents: Complete visitor consent records
- • documents: Contract drafts, templates & versions
- • audit_logs: Proof hash chains & timestamps
- • Customer-controlled: Full backup & encryption ownership
HashEntry Platform DB (System & Subscription Metadata)
- • Encrypted connection details of your database
- • users: Team accounts & session tokens
- • plans: Quota limits & license tiering
- • billing: Invoices & subscription status
BYOD Database Size & Storage Simulation
Estimate the growth rate, monthly/yearly storage requirements, and recommended hardware specifications for your customer-hosted PostgreSQL cluster.
Monthly Consent Volume
Estimated monthly cookie consent decisions and document approvals recorded across all your domains.
Total registered sites and apps streaming consent events to your database.
Share of consents that get an RFC 3161 timestamp from the configured timestamp authority.
Storage window for webhook HTTP payload and response logs sent to external CRM / Data Lakes.
Recommended PostgreSQL Cloud & Hardware Spec
Starter / LightweightBased on your projected storage footprint and write throughput, here are the recommended minimum server specifications:
AWS RDS db.t4g.micro/small • Hetzner CPX11 • GCP db-custom-1-2048
PostgreSQL Range Partitioning Built-in
HashEntry partitions the consents and metadata tables by month (PARTITION BY RANGE created_at). Older months can be detached and archived, which helps keep queries on recent data fast.
Storage & Record Breakdown by Data Category
Detailed volume estimation for each data category, estimated record byte size (including PostgreSQL tuple header, JSONB payloads, B-Tree and GIN indexes), and projected storage footprint:
| Data Category | Avg. Record Size | Projected Records | Storage Footprint | Share |
|---|---|---|---|---|
| Consent & Choice Records | ~1 KB | 600,000 | 686.6 MB | 73.4% |
| RFC 3161 Cryptographic Timestamps | ~4 KB | 30,000 | 128.7 MB | 13.8% |
| Integration & Webhook Logs | ~2 KB | 50,000 | 85.8 MB | 9.2% |
| Custom Form & Metadata Fields | ~160 B | 120,000 | 18.3 MB | 2.0% |
| Visual Banner Audit Snapshots | ~3 KB | 216 | 738.3 KB | 0.1% |
| Daily Analytics Aggregations | ~200 B | 2,160 | 421.9 KB | 0.0% |
| DSAR & Right-to-be-Forgotten Records | ~400 B | 180 | 70.3 KB | 0.0% |
| Configuration & Document Templates | ~15 KB | 76 | 15 MB | 1.6% |
| Total Records | - | 802,632 | 935.7 MB | 100.0% |
Estimations include PostgreSQL HeapTupleHeader (23 bytes), NULL bitmap, JSONB binary compression overhead, B-Tree and GIN indexes, TOAST table compression, and a 20% page fillfactor buffer. Actual disk footprint may vary by ±10% depending on autovacuum frequency and custom JSON attributes.
Your Database, Your Records
Consent records are written to your own PostgreSQL rather than to a HashEntry-managed tenant database. Platform metadata, queues and logs remain on the platform.
Custom Backup & PITR
Backup cadence, retention policies, and disaster recovery drills are managed entirely according to your internal IT compliance standards.
You Choose the Database Location
You decide where your database is hosted, which can support your data-localisation requirements. Because requests are processed on the platform, cross-border transfer rules still need your own assessment.
Dedicated Database for Your Records
With BYOD your consent records live in your own server and schema, not in the shared tenant-scoped database used by the default plan.
Data Location Matrix
| Data Category | Stored Location | Details |
|---|---|---|
| Consent & Choice Records | Customer PostgreSQL | Consent records are written to your own PostgreSQL rather than to a HashEntry-managed tenant database. Platform metadata, queues and logs remain on the platform. |
| Document Contracts & Versions | Customer PostgreSQL | Consent records are written to your own PostgreSQL rather than to a HashEntry-managed tenant database. Platform metadata, queues and logs remain on the platform. |
| Anonymization & IP Hash Logs | Customer PostgreSQL | With BYOD your consent records live in your own server and schema, not in the shared tenant-scoped database used by the default plan. |
| In-Database Cryptographic Audit (PL/pgSQL & Merkle) | Customer PostgreSQL | Consents and Merkle roots are independently verified inside PostgreSQL using native SQL functions. |
| User Accounts & Authentication Sessions | HashEntry Platform DB | HMAC-SHA256 hashed credentials & session tokens |
| Subscription & Billing Metadata | HashEntry Platform DB | Plan subscriptions, quota limits, invoice records |
| TSA Timestamp Requests | RFC 3161 TSA Provider | Only the SHA-256 digest is sent; document or consent content is not transmitted to the timestamp authority. |
In-Database PL/pgSQL & Merkle Tree Verification Support
Audit consent integrity and batched Merkle Tree root proofs directly within your PostgreSQL database using independent PL/pgSQL functions—with zero reliance on external APIs. The verification pack is securely provided to BYOD clients via the management portal.
Batched Merkle Tree Verification
Verify leaf and audit paths for millions of consents batched under RFC 3161 TSA-stamped roots directly using pure SQL.
Fully Offline & Air-Gapped
Execute forensic and compliance audits within your private network without connecting to HashEntry servers.
Date-Range Integrity Scanning
Audit all consent records and Merkle proofs within any date range in a single query to detect discrepancies.
Secure Management Portal Access
The verification pack is provided to BYOD customers through the management portal.
Technical Requirements & Compatibility
PostgreSQL 16, 17, and 18
TLS 1.3 / SSL Mode 'require' or 'verify-full'
Compatible with PgBouncer and standard poolers
Static IP allowlisting or private VPN/VPC peering
Strengthen Your Compliance Evidence Today
Start with the free plan. No credit card required.