Oracle Database Vault. The complete licensing guide.

Oracle Database Vault is a separately licensed option on Oracle Database Enterprise Edition. It enforces separation of duties for privileged users (DBAs cannot see application data without explicit grant) and applies command rules that restrict who can run what against which schema.

The licensing is straightforward in principle. Database Vault carries the same metric and the same processor count as the underlying Database Enterprise Edition deployment.

The exposure is straightforward too. Most customers either over deploy by licensing the option on every database when only a small subset needs it, or under deploy by enabling the feature on databases that are not licensed for it.

This guide is the complete buyer side reference. Read it alongside the Database licensing guide, the Database pricing 2026 reference, and the Oracle knowledge hub.

What Oracle Database Vault actually does

Database Vault is a privileged user control product. It does three things that the base Enterprise Edition does not do natively.

The three core functions

• Separation of duties. A DBA holds SYSDBA but cannot select from a protected schema without an explicit Database Vault realm authorization.
• Command rules. Restricts who can issue specific SQL commands (ALTER TABLE, CREATE USER, GRANT, EXECUTE on a specific package) based on factor evaluation.
• Factors and rules. Authentication factors (IP address, time of day, application context) feed rule evaluation that the database enforces at the SQL execution layer.

Common buyer side use cases

• Outsourced DBA controls. Where database administration is delegated to an offshore or third party provider, Database Vault prevents the DBA from reading PCI, PHI, or sensitive financial data.
• Regulatory separation. SOX, HIPAA, PCI DSS, and GDPR controls that require demonstrable separation between privileged operations and data access.
• Insider threat controls. Internal DBA staff prevented from running ad hoc queries against protected schemas without business approval.
• Multi tenant database segregation. Where one Oracle Database instance hosts multiple business units or customer schemas with strict cross access controls.

Edition prerequisites and stack dependencies

Database Vault sits on top of Database Enterprise Edition. The licensing math starts with the underlying EE deployment.

Required underlying license

• Database Enterprise Edition. Required prerequisite. Database Vault is not available as an option on Standard Edition 2.
• Multitenant. Database Vault works inside multitenant container and pluggable databases, but the licensing of Multitenant is a separate decision with its own option price.
• Audit Vault. Often deployed alongside Database Vault but is a separately licensed product, not an option on the database.
• Advanced Security. A separately licensed option that delivers Transparent Data Encryption and Data Redaction. Different scope from Database Vault, often paired in regulated environments.

Real Application Clusters and Data Guard considerations

• RAC. Database Vault enabled on a RAC cluster licenses every cluster node, each processor counted under the EE metric.
• Data Guard physical standby. A licensed primary covers the standby for ten days of testing per year. Database Vault enabled on the primary requires the option on the standby if the standby is opened read write or used outside the 10 day rule.
• Active Data Guard. Active Data Guard is a separately licensed option. Database Vault on a Data Guard physical standby used in Active Data Guard read mode requires Database Vault on the standby.
• GoldenGate. GoldenGate environments with Database Vault enabled on the source or target carry their own option licensing on each affected database.

Metric, price, and the math

Database Vault is licensed on the same metric as the underlying Database Enterprise Edition deployment. Two metrics matter.

Database Vault price benchmarks

Metric	List price	Minimum	Annual support
Processor	23,000 USD per processor	None at the option level	22 percent of net license fee
Named User Plus	460 USD per NUP	25 NUP per processor applied to EE	22 percent of net license fee

Processor metric math

The processor count under Oracle's core factor table applies. On modern Intel x86 processors the factor is 0.5. A 32 core x86 server runs 16 processor licenses. Database Vault on that server runs 16 option licenses at 23,000 USD each.

• Per server license math. 32 cores times 0.5 core factor equals 16 processor licenses. Sixteen Database Vault option licenses at 23,000 USD list equals 368,000 USD per server before discount.
• Eight server estate. 16 processors per server times 8 servers equals 128 processors. Database Vault at 128 processors and 23,000 USD list equals 2.944M USD before discount.
• Annual support. 22 percent of net license fee. After a 40 percent discount on the 2.944M USD estate, the annual support runs at 388K USD.

NUP metric math

• NUP minimum applies. The 25 NUP per processor minimum is applied to the underlying EE deployment, not separately to Database Vault.
• Per user math. 460 USD per NUP for Database Vault. On a 400 NUP deployment, Database Vault runs 184K USD at list.
• When NUP makes sense. Small named user populations on dedicated infrastructure typically license cheaper on NUP than on processor.
• When NUP does not work. Internet facing databases, high concurrency analytic workloads, and large transactional systems with thousands of users typically run cheaper on processor.

Audit risks and exposure patterns

Oracle LMS audits target Database Vault because the configuration data is in the database itself. The audit script extracts the option installation and option usage data in minutes.

How the audit detects Database Vault usage

• DBA_REGISTRY view. Shows whether the Database Vault component is installed in the database.
• DBA_OPTIONS view. Shows the option installed at the database level.
• DV_REALMS, DV_RULES, DV_FACTORS views. Show the configured Database Vault objects. The presence of objects indicates active use.
• FEATURE_USAGE_STATISTICS. The database tracks the usage of feature options. Database Vault usage shows in the table with a count of detected uses and last used dates.

Three common exposure patterns

1. Build template drift. Database Vault enabled on a small set of databases for a regulated workload, then standardized into the database build template. Two years later the option is enabled on every new database.
2. Dev test sprawl. Database Vault enabled on production cloned to dev test environments without licensing the option on the dev test footprint.
3. RAC node count growth. Database Vault licensed on the initial RAC cluster size, then the cluster grows by additional nodes without updating the Database Vault option license count.

Alternatives to Database Vault

Not every regulatory control requires Database Vault. Several alternatives address subsets of the use cases at lower cost.

The four common alternatives

• Native auditing. Oracle Database includes a native audit capability. With careful configuration, audit logs of every SYSDBA action provide the audit trail that some regulators accept in lieu of separation of duties.
• Application level access controls. Database access mediated only through the application, with no direct DBA query access permitted by policy and enforced through procedure.
• Third party database firewall. Products from non Oracle vendors deliver row level and command level controls on the database boundary, outside the licensed option.
• Transparent Data Encryption (Advanced Security). Where the regulatory control is data at rest protection, TDE may be sufficient without Database Vault. Advanced Security is a separately licensed option on Database EE.

Cost compare for a 16 processor deployment

Approach	License cost (one time)	Annual support	Operational fit
Database Vault on 16 processors	368,000 USD	81,000 USD	SOX, HIPAA, PCI strong fit
Native auditing plus procedural controls	0 USD additional	0 USD additional	Lower assurance, regulator acceptance varies
Third party database firewall (16 processor)	140,000 to 220,000 USD	30,000 to 48,000 USD	Strong fit, no Oracle entitlement risk
Advanced Security TDE plus procedural controls	240,000 USD (17,500 USD per processor for ASO list, on 16 processors after 14 percent discount)	53,000 USD	Data at rest control only

Worked examples: three customer scenarios

Scenario one: pharma with offshore DBA

A global pharma customer outsources Oracle Database administration to an offshore provider. The regulator requires that the offshore DBA cannot query patient clinical trial data without an audit trail and an in country approval workflow.

• Right answer. Database Vault enabled on the four clinical trial databases. Sixteen processors total. 368K USD list, around 220K USD net of standard 40 percent discount.
• Wrong answer. Database Vault enabled on every database in the estate (84 databases, 128 processors). 2.944M USD list, 1.76M USD net of discount, only 5 databases actually needing the control.
• Vendor Shield outcome. Disable Database Vault on the 80 databases not in regulatory scope. Reduce the licensed processor count from 128 to 16. Annual support drops from 388K to 48K.

Scenario two: bank with internal DBA team

A regional bank runs an internal DBA team. The audit requirement is separation of duties between DBAs and the trading desk schema. Six databases hold trading data.

• Right answer. Database Vault on the six trading databases. Twenty four processors. 552K USD list, 330K USD net.
• Alternative considered. Native auditing plus procedural controls. The internal audit committee accepted the alternative for two databases that hold low risk reference data. Net license saved 92K USD.
• Final licensed footprint. Sixteen processors of Database Vault. 368K USD list, 220K USD net.

Scenario three: utility with PCI scope

A utility customer with a PCI in scope billing database. One database, two processors. The simple answer.

• Licensed footprint. Two processors of Database Vault. 46K USD list, 28K USD net.
• Audit posture. Documented DBA_REGISTRY export, documented DV_REALMS configuration. No drift across the rest of the estate because the option is explicitly excluded from the build template for non PCI databases.

Seven commercial levers procurement carries

The Database Vault renewal carries the same negotiation table as the broader Oracle Database renewal. Seven specific levers apply.

The seven levers

1. Right sizing before the order. Disable Database Vault on the databases that do not need it before signing the renewal that locks the option count in.
2. Migrate to alternatives. Move databases to alternative controls where the regulator accepts them. Reduce the option count.
3. Bundle with other options. Negotiate Database Vault discount inside a multi option order alongside Advanced Security, Partitioning, and Multitenant.
4. Support uplift cap. Cap the annual support uplift at 3 to 4 percent across the renewal term.
5. Audit posture protection. Make explicit reference to the documented ELP and require Oracle to acknowledge it in the renewal correspondence.
6. RAC and Data Guard scope clarity. Document the exact RAC cluster size and Data Guard topology in the order document to avoid drift.
7. Build template control. Document the build template exclusion and audit it quarterly to prevent future drift.

What to do next

The checklist takes a Database Vault customer from current state to a clean licensed footprint and a defensible renewal position.

1. Inventory every database with Database Vault installed or enabled. Pull DBA_REGISTRY and DBA_OPTIONS exports across the estate.
2. Cross reference to FEATURE_USAGE_STATISTICS. Identify which databases actually use Database Vault (configured realms, rules, factors) vs installed but not used.
3. Map to the order documents. Reconcile the licensed processor or NUP count to the deployed processor or NUP count by database.
4. Identify the regulatory scope. Determine which databases actually require Database Vault for regulator compliance.
5. Decommission the unnecessary use. Disable Database Vault on databases that do not require it. Update the build template.
6. Build the audit defense pack. ELP, configuration export, usage statistics export, decommission evidence.
7. Take the position to the renewal table. Right sized count, documented controls, support uplift cap, build template lock in.

Frequently asked questions

How Redress engages on Database Vault advisory

Redress runs Database Vault advisory inside the Vendor Shield subscription, the Oracle services practice, the Software Spend Assessment, and the Renewal Program.

Read the related database licensing guide, the database pricing 2026, the ULA decision framework, the contract renewal strategy, the contract negotiation service, the Oracle knowledge hub, the PeopleSoft third party support, the PeopleSoft compliance, the benchmarking page, the about us page, and the contact page.