New blog post|What Hardpoint is and where we're going

Read now
Alpha is live Start here

Programmable tenant isolation.

Add tenant isolation and data-residency capabilities to your product with Hardpoint's Postgres-compatible data platform.

Get started Read the docs

Isolated infrastructure in 5 minutes.

Cryptographically separated databases for each tenant, no big rewrites.

terminal
# Provision a tenant
npm @hardpointlabs/cli create tenant acme-corp \
  --region de-htz-flk

# This tenant wants to hold their own key
npm @hardpointlabs/cli create tenant madrigal \
  --region de-aws-fra --key arn:aws:kms:eu-north-1...

# Provision a database fleet
npx @hardpointlabs/cli create fleet pg_prod \
  --type postgres:15

# Show fleet with sovereign regions
npx @hardpointlabs/cli get fleet pg_prod --show-regions

# NAME      REGION      SIZE   TENANTS  DB
# pg_prod               16GiB  2/2      postgres:15
# ∟         de-htz-flk  7GiB   1/1
# ∟         de-aws-fra  9GiB   1/1

Decouple tenants and databases

Create a tenant, specify which sovereign region their data lives, and it's auto-provisioned in the right place.

Tenants are completely cryptographically independent: separate DBs, network paths, encryption keys and audit trails. Hardpoint's platform treats governance & storage as separate concerns.

Single control plane: manage tenants + thousands of databases across sovereign regions like you're managing a storage array.

index.ts
import { Sdk, TenantKey } from '@hardpointlabs/sdk'
import { pgConfig } from '@hardpointlabs/postgres'
import { Client } from 'pg'

// Set up the Hardpoint SDK
const sdk = Sdk.init({orgId: process.env.HARDPOINT_ORG})

// Create a secure encrypted tunnel to
// this tenants' dedicated database
const tunnel = sdk.connect({
  // prod postgres...
  service: 'postgres_prod',
  // ...belonging to acme-corp
  tenant_key: TenantKey.from('acme-corp')
})

// Create a Postgres client using the tunnel
const pg = new Client(pgConfig(tunnel))

Treat thousands of DBs as one

The SDK is your single integration surface. Call Sdk.connect() with an service name and tenant, and Hardpoint handles the rest — network routing, database provisioning, and secure connection management.

No config files. The infrastructure figures it out.

Explore the SDK

Three components, one system

SDK, Connect, and Lattice work together to give every tenant isolated infrastructure — without you managing per-tenant complexity.

SDK

The integration surface. A TypeScript SDK that turns service discovery and secure tunneling into a function call. Manages identity, routing, and resource allocation so your app code stays clean.

The SDK exposes a socket you can use with all your standard database client libraries with all the private networking and auth handled transparently.

What others don't: single API for network + compute isolation, so you don't stitch together half a dozen services.

SDK repo Docs
src/index.ts
import { Sdk } from '@hardpointlabs/sdk'

// Set up the SDK singleton
const sdk = Sdk.init({orgId: process.env.HARDPOINT_ORG})

// Provision with storage and network
const tenant = await hp.tenants.provision({
  id: 'acme-corp',
  region: 'eu-west-1',
  storage: { type: 'postgres:15', size: '100GB' }
})

// Use the connection string immediately
process.env.DATABASE_URL = tenant.connectionString

Connect

Secure outbound-only tunnels between your infrastructure and your tenants. No open ports, no IP whitelisting, no zero-dot-zero-dot-zero-zero-slash-zero.

What others don't: provisioned automatically by the SDK — no separate Connect config required.

Connect docs
terminal
# Connect is managed through the SDK,
# but you can inspect networks directly:

npx hardpoint connect list --tenant acme-corp

# NAME       REGION       STATUS    AGE
# acme-corp  eu-west-1    active    12d
# widget-co  us-east-1    active    3d

npx hardpoint connect logs --tenant acme-corp

# 2026-05-28T10:23:15Z tunnel established
# 2026-05-28T10:23:16Z routing table synced

Bringing your own infrastructure?

The Hardpoint agent makes existing private resources first-class participants in a Connect network — deployable in your environment, auditable end-to-end. If you have an existing database, API, or service behind a firewall, the agent connects it without exposing anything to the internet.

Agent repo

Lattice

Per-tenant database fleets, provisioned on demand. Dedicated Postgres instances, storage volumes, and compute — spun up when you call provision and torn down when you're done.

Lattice runs within a Connect network — provisioned automatically by the SDK when you request storage.

Lattice docs
terminal
# Lattice databases are provisioned via the SDK.
# Inspect them from the CLI:

npx hardpoint lattice list --tenant acme-corp

# ID       TYPE          REGION       STATUS
# db-01    postgres:15   eu-west-1    running
# db-02    postgres:16   eu-west-1    running

npx hardpoint lattice scale db-01 --size 200GB

# Resizing db-01 from 100GB to 200GB...
# Done. Connection string unchanged.

Open source where it matters

Open source core

SDK, agent and framing protocol are all public. You can audit every layer — from the provisioning API to the wire format — and verify there are no back doors.

GitHub organization

End-to-end encrypted

The framing protocol between SDK and agent is open source and cryptographically verified. Nobody — including us — can eavesdrop on your traffic. Your data is 100% private.

Read the docs

Pricing

We're in alpha and working with design partners. Pricing will be usage-based and transparent. If you want to be first in line, get in touch.

Alpha

Free

During alpha

  • Up to 5 tenants
  • Single region
  • Community support

Launch

TBD

Usage-based

  • Unlimited tenants
  • Multi-region
  • Priority support
  • SSO & audit logs

Enterprise

Custom

Volume pricing

  • Dedicated support
  • Custom SLAs
  • On-prem option
  • Data residency guarantees

Questions? hello@hardpoint.dev