stash-encryption

Field-level encryption in TypeScript uses client-side encryption to secure individual data fields before they leave your application, ensuring data security at rest and in transit. This approach integrates with zero-knowledge key management to protect sensitive information.

Searchable encryption enables encrypted data to be searched directly in PostgreSQL using equality, range, and full-text search queries. This allows you to maintain data security while still performing standard database operations on sensitive fields.

Zero-knowledge key management integrates with ZeroKMS to provide secure, end-to-end encrypted key management. This ensures that encryption keys are managed without exposing them to the service provider, maintaining a true zero-knowledge environment.

Multi-tenant support provides cryptographic isolation between tenants using distinct keysets. This ensures that data encrypted for one tenant remains inaccessible to others within the same application infrastructure.

Identity-aware encryption locks encryption and decryption operations to specific users via JWT-based lock contexts. This restricts data access so that only the authenticated identity associated with the token can decrypt the protected fields.

Searchable encryption supports equality, range, and full-text search queries directly in PostgreSQL but requires client-side encryption before data leaves your application. Operations are limited to supported query types and depend on ZeroKMS for key management.