At a glance
| Supported databases | Oracle Database only (cloud, on premises, other clouds, Amazon RDS for Oracle) |
| Auditing and activity monitoring | Yes: audit trail collection, alerts and reports |
| Masking | Yes: masking of non-production copies with fictitious but realistic values, plus data subsetting |
| Encryption or tokenization | Not a Data Safe feature |
| Privileged access | User assessment of privileged accounts; not a password vault |
| Policy enforcement | SQL Firewall allow lists (Oracle AI Database 26ai) managed centrally |
| Compliance reporting | Assessments against STIG, CIS and GDPR; audit reports |
| Deployment | Managed OCI service; private endpoints or on-premises connector |
| Licensing | Included with Oracle cloud databases; 1 million audit records per target per month free; on-premises targets billed (waived to 28 February 2027) |
If your Oracle databases run in Oracle Cloud, Data Safe is the obvious first step: it is included with those databases, apart from audit volume above 1 million records per target per month. It only covers Oracle Database, though, so mixed-engine estates need another tool alongside it.
Overview
Oracle Data Safe is a regional service in Oracle Cloud Infrastructure that connects to Oracle databases and offers security assessment (configuration checked against STIG, CIS benchmarks, GDPR recommendations and Oracle practice), user assessment of risky and highly privileged accounts, activity auditing with central audit policy management, data discovery of sensitive columns, data masking for non-production copies, and data subsetting that builds smaller non-production datasets with percentage rules or filter conditions. It also manages SQL Firewall, which is built into the Oracle AI Database 26ai kernel and enforces allow lists of approved SQL and connection paths.
Targets include Autonomous AI Databases, OCI database systems on virtual machines, bare metal and Exadata, Cloud@Customer, on-premises Oracle databases and Oracle databases on compute instances in OCI or other clouds, connected over TLS or encrypted TCP through private endpoints or an on-premises connector. Audit records are kept online for up to 12 months and can be archived for six more years, seven years in total.
Key features
- Security assessment against STIG, CIS benchmarks, GDPR recommendations and Oracle best practices
- User assessment flagging highly privileged and risky accounts, linked to audit records
- Activity auditing with central audit policy management, alerts and reports
- Data discovery of sensitive columns with built-in and custom sensitive types
- Data masking with predefined formats for non-production copies
- Data subsetting of non-production copies by percentage rules or filter conditions, which can be combined with masking
- SQL Firewall management for Oracle AI Database 26ai allow lists
- Audit retention of up to 12 months online plus 6 years of archive
Integrations and ecosystem
Pros and cons
Pros
- No additional cost for Oracle cloud databases, apart from audit overage
- Assessment, auditing, discovery and masking in one managed console
- Manages SQL Firewall for Oracle AI Database 26ai
- Paid audit collection can be capped per target
Cons
- Oracle Database only; no SQL Server, PostgreSQL or MySQL targets
- Online audit retention is capped at 12 months (archive for older data)
- If paid usage is disabled, audit collection stops once the free monthly limit is hit
- Per-target and overage prices sit on the Oracle price list, not in the documentation
Pricing
Data Safe comes at no additional cost with Oracle cloud databases: Oracle's Autonomous AI Database documentation says it is included for all workloads. For every target, the first 1 million audit records collected per month are free; beyond that, paid usage applies at Oracle Cloud price list rates (enabled by default, and can be switched off per target, which stops collection until the next month). On-premises Oracle databases, databases on compute instances and Amazon RDS for Oracle are normally billed per registered target, but Oracle is waiving those charges from 12 June 2026 to 28 February 2027 (audit overage still applies). Per-target and overage prices are on the oracle.com price list, which could not be read automatically, so they are not quoted here. A 30-day free trial is available.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
Teams running Oracle databases in Oracle Cloud, or Oracle estates that want a managed assessment and audit service instead of an appliance.
Typical use cases
- Running regular security and user assessments across an Oracle fleet
- Centralising Oracle audit trails with alerts for privileged activity
- Finding and masking personal data before copying production to test
- Rolling out SQL Firewall allow lists on Oracle AI Database 26ai
Who should look elsewhere
- Mixed-engine estates: see Microsoft Defender for SQL for SQL Server or DataSunrise for many engines.
- Organisations that need a network SQL firewall in front of on-premises databases: see Oracle Audit Vault and Database Firewall.
Verdict
Oracle Data Safe gives Oracle Cloud customers assessment, auditing, discovery, masking and SQL Firewall management at little or no extra cost, and now reaches on-premises and other-cloud Oracle databases too. Its scope stops at Oracle Database, so it complements rather than replaces a multi-engine monitoring tool.
Frequently asked questions
Is Oracle Data Safe free?
For Oracle cloud databases it is included at no additional cost, and every target gets 1 million audit records per month free. On-premises and compute-instance targets are normally billed, with charges waived from 12 June 2026 to 28 February 2027, and audit overage is charged at price list rates.
Can Data Safe protect databases outside Oracle Cloud?
Yes, Oracle databases only: on-premises Oracle databases, Oracle databases on compute instances in OCI or other clouds, Exadata Cloud@Customer and Amazon RDS for Oracle.
How long does Data Safe keep audit records?
Up to 12 months online, plus up to 6 years in the archive, for a maximum of 7 years. Archived data can be retrieved up to six times per month per target.
How does Data Safe compare with Microsoft Defender for SQL?
Data Safe covers Oracle databases with assessment, auditing, discovery, masking and SQL Firewall management. Defender for SQL covers Azure SQL and SQL Server with vulnerability assessment and threat alerts, billed through Defender for Cloud; neither covers the other's engine.
Sources
- Oracle Data Safe overview
- Oracle Data Safe service limits
- Oracle Data Safe audit profiles (free records and paid usage)
- Oracle Data Safe promotion for on-premises databases
- Try Oracle Data Safe for free
- Autonomous AI Database security features overview
Checked November 2026.
Listed in: Database Security & Auditing.
How we research reviews and what star ratings mean: our editorial method.