Choose the protection boundary
your product needs to own.
Embedding a database, configuring a database service and protecting a network connection solve different integration problems. Start with the decisions your team needs to control.
Bring the data lifecycle into the application.
8DB brings encrypted storage, native data structures, access policy and mesh coordination into an embeddable engine. Its reviewed protected-node path adds recipient-specific post-quantum messages and independent storage keys at the receiving node.[6] That combination is worth evaluating when your application needs to own both the data and how authorized copies move.
The published Required node profile currently admits canonical lexical records. An evaluation adds the application schemas, deployment conditions and failure behavior your product needs. Follow the results for each part of the lifecycle.
Put the same questions to each approach.
These options can also work together. The comparison follows their documented configurations and 8DB’s inspected implementation; it is an architecture comparison, with performance measured separately for a defined workload.
| Decision | 8DB reviewed composition [6] | SurrealDB [1, 2] | Oracle AI Database 26ai [3, 4] | Cloudflare Tunnel [5] |
|---|---|---|---|---|
| Deployment | Embed the engine and integrate its storage and mesh APIs. | Embed a multimodel engine, self-host it or use managed infrastructure. | Operate a database service with compatible clients. | Run cloudflared between your origin and Cloudflare. |
| Protection boundary | Local encrypted storage and recipient-specific PQC messages, verified and opened by the receiving node. | The documented guidance combines TLS with disk, cloud or datastore-backend encryption. | ML-KEM or hybrid TLS 1.3, ML-DSA certificates and AES-256 transparent data encryption. | PQC key agreement on QUIC. The --post-quantum option requires PQC without fallback. |
| Change over time | Evaluate governed migration, interruption, cold recovery and current-policy refusal against a selected source profile. | Coordinate the database, encryption backend and recovery policy you select. | Configure TLS groups and certificates; re-encrypt tablespaces with REKEY. | Configure connector protocol and routing; manage stored-data migration in the data system. |
| What you operate | Application integration, node enrollment, endpoint key custody and the recovery policy. | The selected deployment and backend, their security settings and permissions. | Database and client configuration, wallets and storage-key operations. | Your connector and account. Cloudflare operates its network endpoint. |
| The acceptance question | Does the integrated data path preserve your rules through delivery, migration and recovery? | Does your chosen configuration meet the application’s data, access and recovery requirements? | Do client/server negotiation, stored-data protection and recovery meet your required profile? | Are the required legs protected? HTTP/2 does not provide PQC key agreement. |
On a narrow screen, scroll the comparison horizontally. A product’s selected version, client support and configuration determine its actual behavior.
Start with the failure your product must survive.
Choose the records, endpoints, authority rules and recovery event. Then compare exact results, storage growth, wire bytes and latency under the same workload. That is how an architectural difference becomes a useful engineering decision.
For 8DB, the public record includes component costs, protected-node recovery and live-migration runs with both successful checks and deadline misses. Those results define the next acceptance test. Inspect the evidence by question ↗
Sources and scope
Primary documentation checked September 16, 2026. Product capabilities and versions continue to change.