Integrations
Every CipherStash integration, by category: the Postgres platforms encrypted data lives in, and the query layers that read and write it.
Every integration below writes the same ciphertext into the same EQL columns, so none of them is a one-way door. You can move a table from one to another without re-encrypting it, and use more than one at once — an ORM for application queries, raw SQL for migrations.
Database
Where the encrypted data lives. EQL installs into any Postgres you can connect to, with no extension and no superuser.
Supabase
Install EQL with the stash CLI, then query encrypted columns through PostgREST. Row Level Security, Supabase Auth, and Edge Functions all apply unchanged.
Prisma Postgres
Prisma's managed Postgres, with EQL installed through the Prisma ORM 8 migration graph.
ORM
How your application queries it.
supabase-js
encryptedSupabase wraps your existing client so .eq(), .in(), .gt(), and .order() keep working on encrypted columns.
Prisma ORM 8
Encrypted EQL v3 columns declared in schema.prisma, with typed encrypted query operators.
Drizzle
Concrete encrypted column types and capability-checked operators. Targets EQL v3.
Not on this list? Any ORM works without an integration — encrypt before a write and decrypt after a read with the Stack SDK, which is what the integrations do for you. CipherStash Proxy covers the case where you cannot change the application at all, and the SDK also encrypts values that never reach Postgres, including non-Postgres stores like DynamoDB.
Still deciding
Choose your stack walks the four decisions in order: SDK or Proxy, your Postgres, your ORM, and your identity provider — including which identity providers can bind decryption to the signed-in user.