Elyse – INTEGRITY BY DESIGN
Elyse is a high-integrity controlled document database platform for systems where data fidelity, auditability and tamper resistance are primary requirements.
This is the initial public pre-release of Elyse representing a complete and production-ready product. The platform is released with an Apache-licensed application layer that is not mandatory, and without bundled vendor services. Instead, Elyse provides a stable, transparent foundation upon which independent vendors, integrators, and internal teams can build. The core is deliberately stable; the absence of churn is a design goal.
For production multi-user environment deployment, the database is licensed on a per database instance basis with no per-user limits or usage metering.
High Integrity
Immutable File Storage
After being stored in an Elyse database, files are immutable for Elyse application users, ensuring their integrity. Files can also be assigned an immutable retention date, which cannot be changed once set, and the file cannot be deleted before that date has passed. Under normal configuration, files can only be deleted via the database and are not accessible outside of database-managed operations.
Secure File-To-Data Relationship
The relationship between files and associated file metadata is managed with strong transactional integrity. Relational data and file data are stored and backed up within the same SQL Server–managed system. The database provides transactional consistency between relational data and file data, including during backup and restore, preventing orphaned data under normal SQL Server–managed operations.
Single Namespace Guaranteed-Unique-Identifier Register
A single Elyse database instance maintains one register of user-facing document identifiers within a single namespace. Identifier values are database-constrained for uniqueness while remaining format-agnostic. Identifiers are editable but can be locked against unauthorised change.
By design, duplicate identifiers cannot be created, including through misconfiguration by use of multiple registers for similar entities. No parallel or proxy identifier register is used, regardless of how identifiers are constructed. Document IDs are abstract entities which relate to files through a parent-child relationship.
High Security
Windows Integrated Security
Elyse relies on Windows Integrated Security, leveraging operating-system-level controls for authentication and access management rather than application-layer security.
Database Layer Trust Boundary
Once a user has logged into a Windows account the Elyse SQL database is the sole arbiter of user authentication. The database maintains a zero trust relationship with the application layer. It uses ORIGINAL_LOGIN() to resolve and authenticate users against SID-based ACLs stored within the database. No token passing occurs. The application layer is only responsible for ensuring that the configuration preserves the integrity of ORIGINAL_LOGIN() responses.
Stateless Security Architecture
User authentication is verified within the database every time a call is made that requires privileges. No token passing occurs. No security state is stored beyond the scope of a single call or single stored procedure.
Fully Parameterised Stored Procedures
All application access to data is enforced through stored procedures. Access by stored procedures to underlying tables is via internal ownership chaining. All stored procedures are fully parameterised and contain no data definition language (DDL), no data control language (DCL), and no dynamic SQL capable of structural SQL injection.
Zero-Privilege Application Layer
The application requires zero privileges and only needs credentials for one or more application roles. Application role credentials allow the execution of stored procedures within role-based schemas. Access to data is further restricted by ACLs checked against ORIGINAL_LOGIN() in each stored procedure that performs a privileged task. The application layer can be segmented by configuring an application with credentials for a single application role, preventing it from executing stored procedures for other roles. Application service accounts are not required to, and must not be, registered within database ACLs.
Full Code Transparency
All code is publicly available and fully transparent. No database code is obfuscated. Application layer code is released under Apache License 2.0.
Audit Logging
Built-in audit logging is provided for essential requirements such as creation of key records, file access and file deletion. Additional fine-grained auditing can be enabled by configuring Microsoft SQL Server Audit.
Fine-Grained Internal Data Access Segmentation
Access to privileged data can be controlled at both the data-level and user-level, with independent permissions for viewing and data editing.
Encryption of Data at Rest
Data at rest can be encrypted using Transparent Data Encryption (TDE) on supported Microsoft SQL Server editions.
Open Architecture
The Elyse database exposes approximately 850 application-facing stored procedures that serve application-layer API endpoints. Any third party may develop an application that interfaces with the Elyse database, or extend or modify the application-layer code released under the Apache License 2.0.
Low Cost, Low Friction, Trust-Based Perpetual Licensing
Single user environment, or non-production multi-user environment: Free, with full access to product features.
Multi-user production: Trust-based perpetual license per-database instance basis. Unlimited users. No restrictions on data volume. Price: US$3,500
Air-Gapped Deployment Ready
The licensing system for Elyse does not need to ‘call home’. Hence Elyse can be immediately deployed to an air-gapped environment.
Environment and Deployment
Elyse requires Microsoft SQL Server Express 2022 or higher. For multi-user network deployment it requires standard Windows and SQL Server administration skills, including Kerberos Constrained Delegation, but minimal specialized knowledge of Elyse itself. It can also be installed locally on a single machine for a single user, with all components – SQL Server, backend and web frontend – self-contained, fully-featured and ready to run.
Elyse is a platform for systems where integrity and security are valued. Lack of a cloud-based deployment option is not an oversight or shortcoming, it is a trade-off that is fundamentally inherent to the high-integrity, high-security, time-tested framework that Elyse is based on.
Support
Elyse is fully functional upon installation and is designed for self-service use. Initial releases do not include formal support; users can rely on the included documentation for installation, configuration and operation. Multi-user network deployments require Windows KCD/AD and SQL Server administration skills.
In the future, authorized service providers will offer optional support, consulting and managed deployment services for organizations that require assistance.
Become an Elyse Authorized Service Provider
Elyse is a robust, enterprise-grade document control platform designed for secure, multi-user deployments on standard Windows and SQL Server platforms. As an Authorized Service Provider you have the opportunity to help organizations deploy, configure and maintain Elyse, delivering professional services that add tangible value.
Multi-user network deployments require standard IT skills, including Windows administration, SQL Server configuration and Kerberos Constrained Delegation, but minimal specialized knowledge of Elyse itself. A team with these skills can provide installation, configuration and ongoing support with confidence.
By joining the Elyse ASP network you gain access to a growing market of organizations seeking secure, fully featured document control solutions, while building revenue through trusted, high-value services – without the need to develop proprietary software expertise. You will receive direct access to the Elyse development team, advance notice of upgrades, plus opportunities to network and collaborate with other ASPs.
Send a proposal to contact@silkwoodsoftware.com