/PROXY
CipherStash Proxy adds transparent, searchable encryption to existing PostgreSQL databases with zero application code changes, powered by EQL and ZeroKMS.
Transparent, searchable encryption for your existing PostgreSQL database. No application code changes. Connect through the proxy. Your data is encrypted at the field level. Your queries still work.
What you get
- Zero code changes. Configure encryption for specific tables and columns. Your SQL stays the same.
- Queries over ciphertext. Equality, comparison, ordering, grouping over encrypted values.
- Written in Rust. High performance, strongly-typed mapping of SQL statements.
- Backed by ZeroKMS. Up to 14x the performance of AWS KMS.
- Prometheus built in. Production monitoring out of the box.
- Runs in a container or as a standalone CLI tool.
CipherStash Proxy uses the Encrypt Query Language (EQL) to index and search encrypted data.
When to use Proxy vs SDK
| CipherStash Proxy | Encryption SDK | |
|---|---|---|
| Best for | DevOps teams adding encryption to existing PostgreSQL apps | Engineering teams building new applications |
| Code changes | Zero. Drop-in replacement for your database connection. | Application-level integration with schema definitions |
| Setup | Docker container, configure env vars | npm install, define schemas, integrate into app |
| Control | Automatic, table/column configuration | Fine-grained, per-field control |
Next steps
Getting started
Get up and running in local dev in under 5 minutes.
Configuration
Docker setup, environment variables, and EQL installation.
Multitenant operation
Keyset scoping for cryptographic tenant isolation.
Searchable JSON
JSONB functions and operators for encrypted data.
Encrypt tool
CLI tool to encrypt existing data in your database.
Deploy to AWS ECS
Step-by-step guide for deploying Proxy to AWS ECS.
Audit features
Statement fingerprinting, redaction, and record reconciliation.
Reference
All config options, CLI flags, Prometheus metrics, and more.
Errors
Complete error reference with troubleshooting steps.
Troubleshooting
ZeroKMS debugging, slow statement logging, and performance.