CAPABILITIES — REFERENCE

Every capability of the platform, without the gloss.

§ 01 — COMPUTE

Compute that disappears, not your budget

Postgres compute falls asleep on its own after idling and wakes on the first packet. You only pay for the seconds that are actually active.

scale-to-zero
Auto-suspend after 5 min idle (configurable), automatic wake on connection via the TCP proxy, metering sampled every 60 s, billed in CU-hours.
pooler
Built-in PgBouncer in transaction mode: hundreds of clients multiplexed over a handful of Postgres connections, automatic wake-on-connect.
read replica
Read-only replicas on any branch, dedicated connection string, independent suspend/resume — ideal for analytics.
bashcold wake
-- compute suspended, resumed on connection
$ psql "postgresql://…@db.lampion.cloud/ep-abc.postgres"
SSL connection (protocol: TLSv1.3)
-- you pay nothing while suspended
mydb=> SELECT now();
2026-08-04 10:42:01.234+00
§ 02 — DATA

A Postgres branch in one second

Copy-on-write: a branch only stores its delta. Create one to test a migration, fill it with fixtures, throw it away afterwards.

branch
Instant copy-on-write fork, protected branches (blocks DROP on main), TTL auto-delete (1h to 30 days), schema diff between branches, reset from parent, merge, and promotion of a branch to main.
seed
Up to 10 ordered SQL scripts per project on Startup (1 on Free), replayed automatically on every new branch — test data, fixtures, extensions.
extensions
pgvector, PostGIS, pg_cron, hstore, uuid-ossp and more, enabled in one click and listed per database.
introspection
Hierarchical navigation databases → schemas → tables (columns, types, defaults), without writing a single query.
bashbranch from main
# copy-on-write fork, isolated, in ~0.4s
$ lampion branches create abc123 staging --parent abc123
→ br-staging · ep-staging · 0.4s
# delete it when you are done
$ lampion branches delete abc123 stg-tid
§ 03 — TOOLING

The console does the heavy lifting

A full SQL editor, real-time observability and regression detection — all without ever leaving the browser.

SQL editor
Multi-tab with history, autocomplete for tables + columns, Explain Analyze in one click, CSV export, inline data editing.
observability
Real-time dashboard (CPU, RAM, I/O, connections, cache hit ratio), 24h history, Postgres logs and email alerts on quotas.
query replay
Capture top queries via pg_stat_statements and replay them side-by-side, source vs target, to catch regressions before merging.
sqlexecution plan
-- Explain Analyze in one click from the editor
mydb=> EXPLAIN ANALYZE
  SELECT * FROM users WHERE email ILIKE '%@corp.com';
Seq Scan on users
  Filter: (email ~~* '%@corp.com'::text)
Planning Time: 0.08 ms
Execution Time: 0.03 ms
§ 04 — DURABILITY

Rewind to the exact instant

Point-in-time recovery by LSN, restore to a fresh branch without touching production, and a standard SQL export so you can leave whenever you want.

PITR
Snapshots by pageserver LSN, restore to a new branch, zero impact on production.
pg_dump
SQL export via the API, filterable by table, to archive or migrate off-platform whenever you want.
migration
Import from RDS, Supabase, Neon or a dump (up to 5 GB, PostgreSQL 12+): the import lands in a dedicated branch, production is untouched. The application cutover stays manual.
bashPITR restore
# capture a restore point (LSN)
$ lampion backups create abc123 main before-migration
→ bk-42 · lsn 0/15A2C08
# restore into a fresh branch
$ lampion backups restore abc123 bk-42
→ branch restored-bk-42 · ep-new

Cloud-to-cloud migration has its own page — see how it works

§ 05 — SECURITY

Zero-trust, by default

Every connection is authenticated, PostgreSQL traffic runs over TLS, and every project gets its own secrets.

SCRAM · TLS
SCRAM-SHA-256 on every connection, TLS required on the PostgreSQL proxy (1.2 minimum, 1.3 negotiated with recent clients, unencrypted connections refused), unique passwords per project (24 chars), IP allowlists, rate limiting.
encryption
In transit: TLS required between your application and the proxy, console and API over HTTPS only with HSTS. At rest: being rolled out across every layer (volumes, object storage, backups), available in Q1 2027.
CMEK · SSO
Per-organization OIDC SSO on advanced plans. CMEK (customer-managed keys, via Scaleway KMS, AWS KMS or Vault) and SAML 2.0 on the Souverain plan, scoped in the contract.
PII masking
Dynamic masking per branch (fake_email, fake_iban, hash, partial…), strict anti-injection allowlist, and an analyst role restricted to anonymized branches only.
isolation
Each database runs in its own pod, in a dedicated namespace, with scoped Kubernetes permissions and NetworkPolicies that cut it off from other customers. Each project's storage lives in its own tenant.
bashTLS handshake
# sslmode=require — TLS 1.3 negotiated, 1.2 minimum
$ psql "postgresql://…@db.lampion.cloud/…?sslmode=require"
SSL connection (TLSv1.3,
  cipher: TLS_AES_256_GCM_SHA384)
# API: Bearer token scoped per organization
$ curl -H "Authorization: Bearer lmp_live_…" \
  api.lampion.cloud/v1/projects
DATA · FRANCE
SCALEWAY
PARIS — FR-PAR-1
§ 06 — SOVEREIGNTY

Your data stays in France

Today, the whole data plane (compute, K8s, S3) runs on Scaleway, in Paris — a single console. No lock-in: the infrastructure is described as multi-provider Terraform, and portability to a second sovereign French cloud is on the roadmap.

Layer Operator Site Host attestation
compute Scaleway Paris — fr-par-1 ISO/IEC 27001 · HDS
pageserver · WAL Scaleway Vitry-sur-Seine ISO/IEC 27001 · HDS
S3 storage (backups) Scaleway fr-par — Vitry-sur-Seine ISO/IEC 27001 · HDS
control plane Lampion (EI) Paris, France SIREN 947 709 275 — not HDS certified yet
Scaleway is ISO/IEC 27001 and HDS certified. Lampion itself is not HDS certified yet: the host's certification does not cover Lampion operating your databases. Lampion operates from Paris. An exportable residency audit proves the location of each layer. The console's Compliance tab gathers the security questionnaire (ready to copy for your AI), DPA acceptance with a certificate, sub-processors and the residency report as a PDF.
§ 07 — TEAM

One console, several organizations

Invite by email, assign granular roles, and let everyone switch between organizations instantly — console actions are logged.

RBAC
owner · admin · developer · viewer · analyst — granular permissions per organization.
invitations
Email invitations with notification, multi-organization membership, instant switching.
audit log
Per-organization audit log, timestamped, kept for 12 months and queryable via API: projects, branches, API keys, members, roles, anonymization and full exports.
account
Self-service deletion of your account or organization (GDPR article 17), email preferences and one-click unsubscribe.
bashinvite a member
# role assigned at invitation time
$ curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","role":"developer"}' \
  api.lampion.cloud/v1/orgs/invitations
→ inv-9a · developer · pending
§ 08 — AUTOMATION

Everything is driven by API

A public REST API, signed webhooks and transparent billing — all embeddable in your CI/CD pipelines, your CLI or your agents.

REST API
100+ documented endpoints, Bearer tokens scoped per organization (lmp_live_…), project + connection string in a single request.
webhooks
10+ events (project.created, endpoint.suspended…), HMAC-SHA256-signed payloads, filtering and per-webhook enable/disable.
billing
Precise metering of compute, storage and transfer, clear plans in euros excl. VAT, payment by card or SEPA transfer, no hidden costs.
bashproject in one request
$ curl -X POST \
  -H "Authorization: Bearer lmp_live_…" \
  -d '{"name":"my-app","region":"fr-par-1"}' \
  api.lampion.cloud/v1/projects
# project + connection string, ready to use
{"id":"abc123","endpoint_id":"ep-abc",
  "connection_string":"postgresql://…
    @db.lampion.cloud/ep-abc.postgres?sslmode=require"}

Full reference for the 100+ endpoints. The full plan and quota breakdown is on the pricing page.

A Postgres that is
yours. From Paris.

Create an account No credit card — 3 projects included.