stash-supabase

Field-level encryption in Supabase is achieved by wrapping the client with a specialized library that automatically encrypts data on insert and decrypts on select, storing encrypted columns as JSONB. This allows seamless querying on encrypted data using standard filters.

Encrypted querying supports a wide range of filters including equality (eq), text search (like, match), range comparisons (gt), and set checks (in, or) directly on encrypted columns. This functionality ensures you can filter sensitive data without exposing plaintext to the database.

Identity-aware encryption allows tying the encryption context to specific user JWTs in Supabase. This enhances security by ensuring encrypted data is strictly scoped and accessible only within the correct user identity context.

Using a field-level encryption wrapper provides transparent encryption and decryption for mutations and selects, securing user PII like emails and personal details. Sensitive data remains protected at rest and in transit while still allowing powerful search queries.

Encrypted querying supports specific filters like eq, like, gt, in, or, and match on encrypted JSONB columns. Complex analytical queries or custom plaintext operations outside these supported filters may not be possible on the encrypted data.