The database that replaces the stack

One record, two models - kept in sync both directions

Every other stack makes you choose: model it as a graph or as documents, then build brittle ETL between the two. Anvil's sync rules bind a node label to a document collection bidirectionally - write a :User node and the auth.users document updates; delete a field from the document and it leaves the node. Conflict resolution, cascade semantics, and trigger ordering are built in. No pipeline, no drift, one source of truth queryable both ways.

SYNC LABEL Person TO COLLECTION persons KEY id
  INCLUDE name, email  -- BIDIRECTIONAL by default

MATCH (p:Person {name: 'Ada'}) RETURN p     -- graph view
GET /docs/persons/ada                        -- document view, same record

Column-level security that follows data across models

Row-level security exists elsewhere. Anvil goes further: property masks hide individual fields per role, and both policies and masks travel through sync pairs - hide email on the :User label and it is hidden in the auth.users collection, in Cypher results, in the REST document API, and in the graph endpoint. One rule, every surface. Readers can't see user emails out of the box.

HIDE PROPERTY email ON :User FROM reader
-- masked in MATCH results, GET /docs/auth.users/*, and /db/graph

Tenants as a database primitive - with portable backups

Apps give every tenant an isolated schema, its own labels and collections, per-tenant settings, and custom auth emails - inside one server. Then the part nobody else ships: one call exports a tenant as a self-contained JSON bundle (data, subgraph, policies, triggers, templates, members), and one call restores it as a new tenant with ids remapped and links to shared identity re-attached. Tenant migration between servers becomes a file copy.

CREATE APP 'crm' NAME 'Customer CRM'
APP 'crm' ADD MEMBER 'alice' PRIVILEGE editor
GET  /apps/crm/export        -- whole tenant as one JSON file
POST /apps/import?slug=crm2  -- restored, remapped, re-linked

The entire platform speaks Cypher

Not just queries. Indexes, triggers, stored functions, RLS policies, property masks, sync rules, storage buckets, runtime settings, and whole tenants are all created, listed, and dropped in Cypher. One language, one audit trail, one mental model - from CREATE INDEX to CREATE APP to SET SETTING, scriptable end to end.

CREATE UNIQUE INDEX ON :User(email)
CREATE TRIGGER after_signup AFTER INSERT ON :User AS { ... }
CREATE POLICY own_rows ON :Order FOR SELECT USING (n.owner = current_user())
CREATE BUCKET avatars PUBLIC
SET SETTING 'app.crm.auth.email.smtp_from' = 'CRM <noreply@crm.io>'

Auth you can traverse

Users, roles, sessions, and tenant memberships aren't rows in a hidden system table - they are graph nodes and relationships you can MATCH like any other data. Link your domain straight to identity ((:Order)-[:PLACED_BY]->(:User)), query who can do what, and get passwordless OTP login, email verification by link or code, service accounts, and per-tenant SMTP - without bolting on an auth service.

MATCH (u:User)-[m:MEMBER_OF]->(a:App {slug: 'crm'})
RETURN u.username, m.privilege

Five services in one safe-Rust binary

A typical stack wires a graph database to a document store, an object store, an auth provider, and a GraphQL layer - five services, five configs, five failure modes. Anvil ships all of it as one self-hostable binary with TLS termination, WAL-first durability, ARIES recovery, snapshots, and the Hammer admin UI included. Your data stays on your hardware.