Only the column
Mark the fields that need it — national ID, account number, email, card number. The other columns stay readable. Unlike disk encryption, a database login does not by itself reveal the protected field.
03 · Column encryption
Encrypt the column. Keep the key outside.
AES-256-GCM on the sensitive columns of PostgreSQL, MySQL, and SQL Server. A data key and a key-encryption key stay apart, and a policy decides who can decrypt and when the key rotates.
How it works
Two layers of keys
Rotating a KEK re-wraps DEKs without rewriting the column data. Replacing a DEK re-encrypts the column, and reads continue during that pass. The manual also describes importing an external KEK and a self-hosted key store for networks that do not send data out.
A policy decides who can read
A policy names the key, table, column, principal (role or service account), allowed operations, and rotation. Manage it from the CLI, the dashboard, or the REST API. Raw key bytes are not exported. Metadata such as name, algorithm, status, and schedule is.
Specification
- Scope
- Column, not table
- Databases
- PostgreSQL, MySQL, SQL Server
- Algorithm
- AES-256-GCM
- Data key
- DEK. Encrypts the column value
- Key-encryption key
- KEK. Wraps the DEK. Plaintext DEKs are not stored
- Application
- Existing SQL when a session token is present
- Direct connection
- Ciphertext without a token
- Rotation
- 30, 60, 90, 180, or 365 days, or manual
- Audit
- Key create, rotate, revoke; policy changes; encrypt and decrypt