dbo.io is a schema-driven application framework. Connect it to an existing MySQL or SQL Server database — or define a new schema — and it generates a complete REST API, cell-level security model, server-side content rendering engine, messaging system (email, SMS, AI chatbot), media management, automation scheduler, and audit trail automatically. There is no middle-tier code to write or maintain.

Writing a backend produces code that must be maintained. When the schema changes, the code changes. When business rules evolve, the code evolves. When a new engineer joins the team, they learn the code.

dbo.io eliminates the middle tier entirely. The schema is the application. Adding a column updates the API automatically. Changing a security rule takes effect everywhere. There is no code to maintain because there is no code. This distinction matters most at scale and over time — code generation reduces upfront cost; schema-driven architecture reduces lifetime cost.

Developers and engineering teams who need to build production-ready APIs, mobile backends, or AI agent infrastructure on top of existing or new MySQL / SQL Server databases. Our existing customers include organizations running enterprise-scale operations and developers building cross-platform applications (iOS, macOS, web, MCP server) from a single API.

MySQL / MariaDB and Microsoft SQL Server. Both are supported for existing database connections (connect dbo.io to a database that already has data and schema) and for new schema definitions.

Yes. This is one of the most common use cases. Connect dbo.io to your existing MySQL or SQL Server instance, sync the schema, and immediately gain a full API surface, security enforcement, and content rendering layer — without changing a single row or column in the original database. Your existing application continues to run against the same data with no interference.

Not currently. MySQL and SQL Server are the supported relational databases.

dbo.io enforces security at three levels — entity, row, and column — plus cell-level access control. All enforcement happens at query construction time, before any SQL executes. Security is not applied to results after the fact; it is built into how the query is generated.

Security rules are data records, not code. Configure them through the Operator management console or the API. Changes take effect immediately with no redeployment.

Cell-level security means access rules can vary by the value of data in a specific field — not just by which rows or columns a user can see, but by the specific content of a cell combined with who is asking. This is the security model enterprise applications with complex, role-dependent access requirements actually need. It is enforced at the query layer, not in application code.

Yes. Agents authenticate as distinct identities and receive security grants exactly as human users do — entity-level, row-level, and column-level. An agent that processes invoices gets access to invoice records and nothing else. The constraint is enforced at the data layer. Every agent action is logged in the revision system with full attribution.

Yes. Mark an output or content as Public to bypass the grant check at the endpoint level, then apply a CurrentUser filter preset inside the output definition. The preset resolves to the authenticated session's UserID at request time — the caller automatically sees only their own rows.

This is ideal for user account views ("my orders", "my profile", "my queue items") where every authenticated user should access their own data without requiring explicit per-user row grants. The endpoint is publicly accessible, but the data returned is always session-scoped.

Email (SMTP), SMS/MMS (Twilio), and AI chatbot (OpenAI). All three use the same template system as content rendering. Messages are logged to queryable database tables. Scheduled delivery handlers handle batch delivery with retry logic.

Yes. dbo.io provides the messaging infrastructure and template system; the channel credentials (Twilio account, SMTP server) are configured as Message Server records in your instance.

Agents use the same REST API as human users. Authenticate, receive a session, and all security rules apply automatically. The /api/app/object/{appName} endpoint returns the full application definition as structured JSON for agent discovery. Schema introspection via /api/output/meta/ lets agents understand available data models. Every write is dry-run by default — agents validate before committing.

Yes. The chatbot integration routes AI tool calls through the platform's existing rendering pipeline. Function names follow a naming convention that automatically maps to platform endpoints — no custom routing code required. Conversation history is stored as queryable database records. The integration uses OpenAI and is configurable as a Message Server record.

Operator is the management console for dbo.io. It provides a full UI for every platform capability — entity editor, query editor, content editor, security manager, media manager, messaging configuration, automation, version management, revision history, and audit trails. Operator is itself a dbo.io application — it runs on the same platform it manages.

Yes. Operator is one interface to the dbo.io API. You can build your own admin panel, management tools, or end-user interfaces using any frontend technology against the same REST API. Many customers build custom-branded interfaces for their end users while using Operator internally for development and administration.

PlotOS is a companion open-source frontend project currently embedded in the Operator app. It is a client-side runtime that turns structured data descriptions (JSON DOM models) into fully functional web applications — workspaces, navigation, widgets, routing, and layout — without writing component code. The core rendering technology is called Plotting, which merges HTML templates with JSON-represented DOM structure.

PlotOS is being extracted from Operator as a standalone open-source library, usable with any backend. It will have its own separate site and brand. Watch for plot-os.io or plot-os.dev.

In your own infrastructure — your VPC, your cloud account, your on-premises servers. There is no shared multi-tenant cloud. Your data never leaves your infrastructure.

dbo.io is a permanent license with one year of software updates included. After the first year, your installation keeps running exactly as it is — nothing breaks, nothing is disabled. Renew to receive further updates.

Source code is provided to clients under the license agreement. Not open-source, but available for audit and emergency patching. A system this central to enterprise operations requires the option of independent maintenance. This is how we've operated with existing clients from the beginning.

Yes — and for most clients, this is how the relationship works. Setup, integration with existing databases, app development, and ongoing maintenance are available as separate engagements. We have built and maintained systems at enterprise scale across the full operational stack.

dbo.io is invite-only. Request access → and tell us what you're building. We vet early partners to ensure the integration is set up right.