Locking down a database
Most database breaches are not clever. They are a port left open to the internet with a weak password. Close that and you have done most of the work.
Do not expose it
A database should listen on localhost or a private network, never on a public address. Bind it inwards, put a firewall rule in front, and reach it from the app over the private side or an SSH tunnel. An internet-facing database port is found by scanners within hours.
Least privilege for every account
The application account needs the rights to do its job and nothing more — no superuser, no access to databases it never touches. Separate accounts for migrations, reporting and backups mean a leaked credential is contained. This is least privilege applied to data.
Encrypt and audit
Require TLS for connections so credentials and data do not cross the wire in clear — see TLS hardening. Turn on the engine's logging for authentication and privileged statements, and ship it off the box with central logging so an intruder cannot erase the trail. Back it all up per database backups.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base