No we cant. Yes the stored procedures, table structures, etc.... We want to prevent any reverse engineering.
Main Topics
Browse All TopicsI developed an internet application that is being hosted. A couple of companies have approached us in regards to utilizing the application but want to utilize it on their intranet instead of the internet. Our SQL server has proprietary information that we do not want customers to see.
Any ideas how I can put on their server and not allow them access to the dbase?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
AS has already been pointed out, having it on a local intranet is going to, basically, require exposing the database. The only solution that I can come up with is to, in effect, host the database locally instead of on the internet.
In other words, suppose you set up a server and the database on site but retain full control over and the only non-programmatic access to the database and server. (Of course, you would need to escrow the SA name/password, etc., in case you and your company get squashed on the freeway. ;-) The idea being that you will maintain the server and the database via remote connections but it will be, "in-house" and on their intranet for all practical purposes.
Of course, since you will have additional expenses involved in dealing with the remote locations for the servers and databases, you will need to charge a bit more for the services but, if the companies are that paranoid, they will probably pay for it. If they opt not to and, instead, opt for the secure internet rather than intranetoption, then you aren't out any more trouble than preparing the proposal. ;-)
Let me try to be a little more clear. We have an internet site which will still be available for customers.
It is the customers who want an intranet solution that we are trying to address. They will not use our functioning internet site. We need to implement our code and dbase on their intranet. We can take care of the code. The issue is SQL Server. We do not want them to have internal access to it if it is on their site.
Additionally, if you provided even 1 user to have a SQL login, the DENY option in the permissions is a very powerful limiting option to keep people out of what you don't want them to see. But first, I simply wouldn't give them any credentials to connect in the first place. Let your code access the dbs only using a SQL login which SHOULD BE encrypted in your code or in the config file for the code. Then just don't ever give those credentials to your customer either.
>> We do not want them to have internal access to it if it is on their site.
Unless you deploy it as an appliance -- pre-installed SQL Server and web interface on your own server that is running at their site -- there is simply no way to do it.
The issue is the SQL Server will integrate to Windows server. And even then if you control all the passwords and such that go into the SQL Server Services, all someone has to do is shut down the SQL Server services, copy the mdf/ldf files to another SQL Server and attach them. Then they have the DB.
@CipherIS
Let me try to be a little more clear. We have an internet site which will still be available for customers.
That was not precluded by my recommendation.
To restate as briefly as possible:
Thus, you maintain your security on your database and the customer maintains their security on thier world.
Whether or not you have a version of the database set up on one or more local sites in this manner has zero impact on your internet site . . . although it does somewhat complicate the application and database maintenance.
Business Accounts
Answer for Membership
by: jimpenPosted on 2009-06-29 at 08:28:28ID: 24737059
>> Our SQL server has proprietary information that we do not ...
When you say proprietary information are you referring to stored procedures and how your system operates?
Could you compile the sp's into DLL's and then make them xp_MyProc?