PCI DSS 4
Disk encryption alone stopped counting in March 2025.
PCI DSS 4 requires more than disk encryption for stored cardholder data. Field-level encryption meets it, queries intact.
PCI DSS 4 →NEWCipherStash now integrates with Supabase
Your database never sees your data.
Queryable encryption for Postgres. Your data stays encrypted while your app is using it, and only an identity-bound policy can decrypt a value.
THE AGENTIC ERA
Agents can't leak what they can't decrypt.
Agents hold your database credentials, and prompt injection is the number one LLM risk. CipherStash caps the blast radius. An injected agent can still run its query, but it only gets back what the requesting user is allowed to decrypt.
[TRUSTED BY]
THE INFRASTRUCTURE
Zero-trust encryption for the database you already use.
Your database stores only ciphertext. Supabase, Neon, and RDS never see your plaintext, and neither do we. Your team decrypts only under policy, and every decryption is logged.
Step through the three states below. The same table and the same query, seen from three places.
patients.sqlREADABLE / 3 ROWS
postgres > SELECT * FROM patients WHERE condition = 'hypertension'| id | name | dob | condition | notes |
|---|---|---|---|---|
| p_01 | Alex Rivera | 1982-04-12 | hypertension | lisinopril 10mg |
| p_02 | Morgan Chen | 1995-11-03 | type II diabetes | metformin 500mg |
| p_03 | Priya Patel | 1971-07-22 | hypertension | atenolol 25mg |
| p_04 | Samir Okafor | 2001-02-17 | hypertension | lisinopril 10mg |
| p_05 | Leah Kowalski | 1988-09-30 | asthma | albuterol inhaler |
SUPPORTED DATA STORES
PostgreSQL
Supabase
Neon
PlanetScale
AWS RDS
DynamoDB
Native plugins for Drizzle and Prisma. Connectors for Auth0 and Clerk.
HOW IT WORKS
Data level access control.
A perimeter breaks the moment someone gets inside it. Data-level access control puts the policy on each value instead, so it holds no matter where the request comes from.
Switch identities below to see what each role can read from the same records.
decryption policyAUTHORIZED
| id | owner | name | dob | condition |
|---|---|---|---|---|
| p_01 | dr.smith | Alex Rivera | 1982-04-12 | hypertension |
| p_02 | dr.jones | mBk|UTcQkcxABP+4UtNqkKsb5p== | mBk|bvklgqmMZOacU/PRlEIRvY== | mBk|xnR1nWZ1Q5WDWkgBmwtFzD== |
| p_03 | dr.smith | Priya Patel | 1971-07-22 | hypertension |
| p_04 | dr.jones | mBk|HxDQvhXkWvyqgOXzMGj0KJ== | mBk|qebLIPw3PE0xhoCIIpws+s== | mBk|n1lyQbKU5a4ufkh/1u+pqh== |
| p_05 | dr.jones | mBk|Ddu9nPfKsxRqpn8KygaZ0u== | mBk|B4OU8aZENJvYsOQc0LOjUE== | mBk|CwvoLxj7Obe6+xZ2zzABNN== |
COMPLIANCE
The encryption your auditor now requires.
Auditors have started asking for field-level encryption by name. CipherStash meets the requirement without breaking your queries.
HIPAA
ePHI encryption is heading from optional to mandatory.
A proposed HIPAA update would make ePHI encryption mandatory. Get ahead of it on the Postgres you already run.
HIPAA →IN PRODUCTION
Trusted by teams that can't get this wrong.
CipherStash enabled us to achieve the same stringent level of encryption without needing to implement custom envelope encryption using AWS KMS or similar technologies.
READ CASE STUDY →With CipherStash, we were able to implement end-to-end encryption while maintaining full search functionality across our entire platform.
READ CASE STUDY →1B+
Encryption ops in production
14x
Faster than AWS KMS
<1ms
Query overhead
SOC 2 TYPE II
Certified
Build with
privacy-first principles.
Your customers' data stays encrypted, even while your app is using it. Encrypt your first fields in 15 minutes, or talk to our team about production architecture.