Techniques are disclosed relating multi-factor authentication for data security. In some embodiments, a computer system receives, from a user device, a database operation request that specifies a set of query data, where the computer system supports multiple different security levels requiring different subsets of a set of authentication factors supported by a known device of a user of the user device. Various devices may determine current contextual information for the database operation request, where the contextual information indicates the set of query data. In some embodiments, the computer system compares the current contextual information with prior contextual information for database requests and then selects a security level from the different security levels. The computer system then initiates verification of a subset of authentication factors corresponding to the selected security level. In some embodiments, the computer system determines, based on the verification, whether to authorize the requested database operation.