CipherStash

CipherStash provides queryable, field-level encryption for applications using PostgreSQL and other supported databases. It is designed to keep data encrypted at all times, including during queries, so that only users or agents with identity-bound decryption policies can access plaintext values. This approach aims to reduce the risk of data leaks, especially in scenarios where agents or applications may be compromised, as unauthorized parties cannot decrypt sensitive information even if they obtain database credentials.

The platform enforces data-level access control, with every encrypted value carrying its own decryption policy. Decryption occurs only after the query is executed and the API response is generated, ensuring that access rules are embedded in the data itself rather than relying solely on perimeter security. CipherStash logs every decryption event, providing an audit trail for compliance and security monitoring. The system is compatible with PostgreSQL, Supabase, Neon, PlanetScale, Amazon RDS, and Amazon DynamoDB, and offers native plugins for Drizzle and Prisma. It also features connectors for Auth0 and Clerk, allowing integration with existing authentication and authorization workflows.

CipherStash addresses compliance requirements such as PCI DSS 4 and proposed HIPAA updates by offering searchable field-level encryption, which is increasingly mandated for the protection of sensitive data like cardholder information and electronic protected health information (ePHI). The platform claims to maintain query functionality while meeting these encryption standards. Performance metrics highlighted include over one billion encryption operations in production, query overhead of less than one millisecond, and speeds up to fourteen times faster than AWS KMS. CipherStash is SOC 2 Type II certified, emphasizing its focus on privacy-first principles and secure data infrastructure.

Developers can integrate CipherStash into their stack using a command-line interface and begin encrypting fields quickly. The service is intended for organizations and teams that require strong encryption and compliance in their data infrastructure, particularly those operating in regulated industries or handling sensitive information.