Two layers. One coherent platform. Everything you need to build, automate, and run distributed systems.
Three Primary Data Access Models
Model 1
Raw SQL Model
The foundational access model. Dapper-style, high-performance parameterized query execution with minimal overhead—as fast as hand-written SQL. Supports a cross-database Markup DSL that lets you write portable SQL once and run it across providers without rewriting queries for dialect differences.
Model 2
Entity Model
Strongly-typed entity mapping with a compile-time-safe execution pipeline. Work with rich domain objects—Kiwi ORM handles result projection, type resolution, and mapping transparently. Catch data access errors before they reach production, not during it.
Model 3
Repository Model Enterprise
JPA-style dynamic proxy generation. Define your data access layer as a typed interface; Kiwi ORM wires the full implementation at runtime. Zero boilerplate, fully testable, and completely decoupled from your persistence mechanism.
Advanced Capabilities
Managed CTE Enterprise
Declare and compose Common Table Expressions as first-class constructs. Build complex multi-step queries—recursive hierarchies, aggregation pipelines, ranked result sets—cleanly and readably, without nested subqueries or string concatenation.
Strongly-Typed Stored Proc Access
Call stored procedures through a fully type-safe interface. Input parameters are bound with type enforcement; result sets are projected directly to typed models. No magic strings, no manual casting, no runtime surprises—stored procs treated as first-class operations.
Provider-Agnostic & Multi-DB
Runs across SQL Server · Oracle · PostgreSQL · MySQL · MariaDB · Db2 · SAP Hana · SQLite · Firebird · MS Access · Informatica. The cross-database Markup DSL abstracts provider-specific syntax—your data access logic stays portable as your infrastructure evolves.
Enterprise Edition
Commercial Edition
Compliance-Level Auditing
Kiwi ORM's commercial edition ships with built-in compliance-grade auditing at the data access layer—not bolted on as middleware, not delegated to the application. Every data operation is captured, attributed, and recorded automatically. Raw SQL execution—including SELECT queries—can be audited when configured, giving complete visibility into all database interactions, not just writes. Where policy demands it, UPDATE, DELETE, and INSERT operations can be configured to require a caller-supplied reason before execution proceeds—creating a traceable chain of intent alongside every data change.
Designed to meet the audit trail obligations of SOX GDPR HIPAA ISO 27001 PCI-DSS without requiring bespoke implementation work in every service.
Who & When
Automatically captures the user identity, timestamp, and session context of every INSERT, UPDATE, and DELETE—at the ORM layer, before it reaches the database.
Field-Level Change Tracking
Records the before and after state of every changed field—not just the final value. Full diff history is preserved, queryable, and exportable for audit review.
Tamper-Evident Trail
Audit records are written to an append-only log structure. No modification, no deletion—records exist permanently and in sequence, satisfying forensic-grade audit requirements.
Zero Application Code
Auditing is configured at the ORM level via policy—no interceptors, decorators, or application-layer hooks required. Compliance coverage is consistent across every operation, every service.
Raw SQL Execution Auditing
Captures every raw SQL statement executed through the ORM—including SELECT queries when configured. Full query text, bound parameters, execution context, and user identity are recorded, giving complete visibility into all database interactions, not just writes.
Enforced Change Justification
When enabled, UPDATE, DELETE, and INSERT operations require a caller-supplied reason before execution is permitted. The justification is captured as part of the audit record—creating a traceable chain of intent alongside every data modification. No reason provided, no execution allowed.
Sync-first execution pipeline · Opt-in async for I/O-bound scenarios · One API, both models
