# Documentation

- [CipherStash Docs](https://cipherstash.com/docs): Searchable field-level encryption, identity-bound keys, and cryptographic audit trails, built into your existing Postgres stack.
- [Access analytics](https://cipherstash.com/docs/concepts/access-analytics): How CipherStash Proxy identifies query patterns, redacts SQL, and associates access events with records and identities.
- [CipherStash Token Service](https://cipherstash.com/docs/concepts/auth): How CTS authenticates client keys and federated identities, then issues short-lived tokens for ZeroKMS.
- [Concepts](https://cipherstash.com/docs/concepts): How CipherStash keeps encrypted data useful and controls access to plaintext.
- [Key management](https://cipherstash.com/docs/concepts/key-management): How ZeroKMS makes unique per-value keys practical: split control, client-side derivation, bounded compromise, immediate revocation, and batch performance without data-key caching.
- [Searchable encryption](https://cipherstash.com/docs/concepts/searchable-encryption): How CipherStash keeps encrypted data useful: query capabilities, the write and query flow, PostgreSQL indexes, and the security tradeoffs.
- [Deployment](https://cipherstash.com/docs/guides/deployment): Deploy CipherStash changes safely across environments, with explicit credential, migration, rollout, monitoring, and rollback gates.
- [Guides](https://cipherstash.com/docs/guides): Deployment and data migration guidance for CipherStash.
- [Data migration](https://cipherstash.com/docs/guides/migration): Move populated plaintext columns to searchable encryption with dual-writes, a resumable backfill, and a reversible read cutover.
- [Choose your stack](https://cipherstash.com/docs/get-started/choose-your-stack): Pick an integration path: SDK or Proxy, your Postgres platform, your ORM, and your identity provider.
- [Get started](https://cipherstash.com/docs/get-started): Encrypt your first field in ten minutes, then pick the integration path that matches your stack.
- [Quickstart](https://cipherstash.com/docs/get-started/quickstart): Encrypt, store, query, and decrypt your first field in Postgres, using the stash CLI and @cipherstash/stack.
- [What is CipherStash?](https://cipherstash.com/docs/get-started/what-is-cipherstash): Field-level encryption that stays queryable in Postgres: the mental model, the pieces, and which door to walk through.
- [Integrations](https://cipherstash.com/docs/integrations): Every CipherStash integration, by category: the Postgres platforms encrypted data lives in, and the query layers that read and write it.
- [Cryptography](https://cipherstash.com/docs/security/cryptography): The canonical account of CipherStash's cryptographic design: the key hierarchy, what ZeroKMS does and does not learn, and what is cached.
- [Architecture & security](https://cipherstash.com/docs/security): Trust model, cryptographic design, availability, audit, and compliance, written to be read end to end during a vendor security review.
- [AI and RAG](https://cipherstash.com/docs/solutions/ai-and-rag): Protect sensitive source text and metadata in AI and retrieval-augmented generation pipelines without giving the database plaintext.
- [Data residency](https://cipherstash.com/docs/solutions/data-residency): Meet data residency rules with regional ZeroKMS deployment, a dual-party key split, and multi-region patterns for cross-border access.
- [Solutions](https://cipherstash.com/docs/solutions): What CipherStash solves: protecting sensitive data, AI and RAG pipelines, data residency, and provable access.
- [Provable access control](https://cipherstash.com/docs/solutions/provable-access): Bind decryption to an authenticated identity with lock contexts, so access to data is cryptographically demonstrable rather than merely logged.
- [Agent skills](https://cipherstash.com/docs/reference/agent-skills): Install CipherStash agent skills to give your AI coding assistant accurate knowledge of encryption setup, schema building, deployment, and integrations.
- [Benchmarks](https://cipherstash.com/docs/reference/benchmarks): Query latency on encrypted columns versus plaintext PostgreSQL. Exact match and range run within 1.2-1.4x of plaintext and stay flat from 10k to 10M rows.
- [Glossary](https://cipherstash.com/docs/reference/glossary): Definitions of key CipherStash concepts and terms, from ZeroKMS, keysets, and client keys to EQL, HMAC, and searchable encryption.
- [Reference](https://cipherstash.com/docs/reference): Precise API documentation for EQL, the Stack SDK, Auth, the CLI, and Proxy.
- [CipherStash vs AWS KMS](https://cipherstash.com/docs/concepts/compare/aws-kms): Compare AWS KMS envelope encryption with CipherStash ZeroKMS: trust boundaries, per-value keys, batching, audit, searchable encryption, and where each fits.
- [CipherStash vs homomorphic encryption](https://cipherstash.com/docs/concepts/compare/fhe): Compare CipherStash searchable encryption with fully homomorphic encryption: supported computations, performance, leakage, PostgreSQL integration, and where each fits.
- [CipherStash vs HashiCorp Vault](https://cipherstash.com/docs/concepts/compare/hashicorp-vault): Why ZeroKMS is a faster and stronger security model than HashiCorp Vault Transit for high-volume application data encryption.
- [Comparisons](https://cipherstash.com/docs/concepts/compare): How CipherStash compares with cloud key management, HashiCorp Vault, hardware security modules, and fully homomorphic encryption.
- [ZeroKMS vs hardware security modules](https://cipherstash.com/docs/concepts/compare/zerokms-vs-hsm): Compare ZeroKMS with dedicated hardware security modules: custody, trust boundaries, integration, availability, per-value keys, and complementary deployment patterns.
- [Overview](https://cipherstash.com/docs/integrations/drizzle): Encrypted columns with Drizzle ORM: pick a concrete EQL column type, and capability-checked operators encrypt your query operands for you.
- [Deployment](https://cipherstash.com/docs/integrations/prisma/deployment): Deploy CipherStash schema changes, backfills, indexes, and credentials safely with Prisma ORM 8.
- [Overview](https://cipherstash.com/docs/integrations/prisma): Searchable field-level encryption for Prisma ORM 8: declare encrypted columns in schema.prisma and query them with the Prisma ORM.
- [Prisma Compute](https://cipherstash.com/docs/integrations/prisma/prisma-compute): Deploy a CipherStash-enabled Prisma ORM 8 application on Prisma Compute.
- [Prisma Postgres](https://cipherstash.com/docs/integrations/prisma/prisma-postgres): Connect the CipherStash Prisma ORM 8 integration to Prisma's managed Postgres service.
- [Quickstart](https://cipherstash.com/docs/integrations/prisma/quickstart): Declare, migrate, write, and query your first encrypted field with CipherStash and Prisma ORM 8.
- [Schema and queries](https://cipherstash.com/docs/integrations/prisma/schema-and-queries): CipherStash column constructors, runtime envelopes, and encrypted query operators for Prisma ORM 8.
- [DynamoDB](https://cipherstash.com/docs/integrations/aws/dynamodb): Encrypt DynamoDB attributes with @cipherstash/stack, including bulk operations and equality lookups over HMAC attributes.
- [Compliance](https://cipherstash.com/docs/security/compliance): How CipherStash capabilities support a compliance control design, and which responsibilities remain with the customer.
- [Supabase Auth](https://cipherstash.com/docs/integrations/supabase/auth): Federate the Supabase Auth session into CipherStash so encryption authenticates as the signed-in user — then, optionally, lock decryption to that user's identity.
- [Edge Functions](https://cipherstash.com/docs/integrations/supabase/edge-functions): Run CipherStash encryption inside Supabase Edge Functions using the @cipherstash/stack WebAssembly build, with the CipherStash token cached across invocations in an HTTP-only cookie.
- [Overview](https://cipherstash.com/docs/integrations/supabase): Add searchable application-level encryption to Supabase while keeping the Supabase client, Auth, Row Level Security, and your choice of Postgres ORM.
- [Quickstart](https://cipherstash.com/docs/integrations/supabase/quickstart): Encrypt, store, and query your first field in Supabase with EQL and the encrypted Supabase JavaScript client.
- [supabase-js](https://cipherstash.com/docs/integrations/supabase/supabase-js): Use the encryptedSupabase wrapper for transparent encryption, decryption, filtering, and ordering through the Supabase JavaScript client.
- [Access keys](https://cipherstash.com/docs/reference/auth/access-keys): Create and manage access keys for production applications, CI, and workspace automation.
- [Client keys](https://cipherstash.com/docs/reference/auth/clients): Understand device-backed and application client keys, keyset grants, revocation, and deployment use.
- [Auth](https://cipherstash.com/docs/reference/auth): Authentication and credential reference for local development, production services, and identity-bound encryption.
- [OIDC providers](https://cipherstash.com/docs/reference/auth/oidc-configuration): Register an identity provider so cryptographic operations can be authenticated as the signed-in end user.
- [Booleans](https://cipherstash.com/docs/reference/eql/booleans): Encrypted booleans are storage-only by design: public.eql_v3_boolean stores and decrypts, carries no index terms, and blocks every comparison.
- [Core concepts](https://cipherstash.com/docs/reference/eql/core-concepts): The model behind every EQL page: domain variants that declare capability, the encrypted payload envelope, the typed-operand rule, and fail-loud blockers.
- [Dates & times](https://cipherstash.com/docs/reference/eql/dates-and-times): The complete reference for encrypted date and timestamp columns: the domain variants, the payload they carry, and time-window, newest-first, and MIN/MAX queries.
- [Filtering](https://cipherstash.com/docs/reference/eql/filtering): WHERE-clause patterns on encrypted columns: equality, IN lists, ranges and BETWEEN, text token matching, JSON containment, and combining encrypted and plaintext predicates.
- [Functions](https://cipherstash.com/docs/reference/eql/functions): Generated catalog of EQL SQL functions and operators (EQL 3.0.4).
- [Grouping & aggregates](https://cipherstash.com/docs/reference/eql/grouping-and-aggregates): GROUP BY on the equality term, eql_v3.grouped_value, DISTINCT ON, COUNT, and eql_v3.min/max on encrypted columns — and why SUM and AVG stay client-side.
- [EQL](https://cipherstash.com/docs/reference/eql): Encrypt Query Language (EQL) installs encrypted column types and operators into Postgres as plain SQL — encryption itself happens in your client.
- [Indexes](https://cipherstash.com/docs/reference/eql/indexes): Create Postgres indexes on encrypted columns using functional indexes over EQL's term-extractor functions.
- [Joins](https://cipherstash.com/docs/reference/eql/joins): Equijoins on encrypted columns: the same-keyset and matching-variant constraint, IN (subquery) and set operations, a worked example, and how to diagnose a join that returns nothing.
- [JSON](https://cipherstash.com/docs/reference/eql/json): The complete reference for encrypted JSON documents with public.eql_v3_json_search — the ste_vec payload shape, value-selector containment, field access, and path queries over ciphertext, with the native jsonb operators that don't apply blocked outright.
- [Numbers](https://cipherstash.com/docs/reference/eql/numbers): The complete reference for encrypted numeric columns: the int, float, and numeric domain variants, the ordering term they carry, and range, ORDER BY, and MIN/MAX queries.
- [Sorting](https://cipherstash.com/docs/reference/eql/sorting): ORDER BY on encrypted columns: which variants sort, when to write the sort key in extractor form, keyset pagination, and the ::jsonb projection trap.
- [Text](https://cipherstash.com/docs/reference/eql/text): The complete reference for encrypted text columns: every text domain variant, the multi-term payload, why LIKE is gone everywhere, and @@ bloom-filter fuzzy match as the encrypted free-text search.
- [stash auth](https://cipherstash.com/docs/reference/cli/auth): Reference for the `stash auth` commands.
- [stash db](https://cipherstash.com/docs/reference/cli/db): Reference for the `stash db` commands.
- [stash doctor](https://cipherstash.com/docs/reference/cli/doctor): Diagnose install problems (native binaries, runtime)
- [stash encrypt](https://cipherstash.com/docs/reference/cli/encrypt): Reference for the `stash encrypt` commands.
- [stash env](https://cipherstash.com/docs/reference/cli/env): Mint deployment credentials and print them as env vars
- [stash eql](https://cipherstash.com/docs/reference/cli/eql): Reference for the `stash eql` commands.
- [stash impl](https://cipherstash.com/docs/reference/cli/impl): Execute the plan with a local agent
- [CLI](https://cipherstash.com/docs/reference/cli): Command reference for the stash CLI, generated from v1.1.1.
- [stash init](https://cipherstash.com/docs/reference/cli/init): Initialize CipherStash for your project
- [stash manifest](https://cipherstash.com/docs/reference/cli/manifest): Print the structured, versioned command surface
- [stash plan](https://cipherstash.com/docs/reference/cli/plan): Draft a reviewable encryption plan at .cipherstash/plan.md
- [stash schema](https://cipherstash.com/docs/reference/cli/schema): Reference for the `stash schema` commands.
- [stash status](https://cipherstash.com/docs/reference/cli/status): Displays implementation status
- [stash telemetry](https://cipherstash.com/docs/reference/cli/telemetry): Manage anonymous usage analytics
- [stash wizard](https://cipherstash.com/docs/reference/cli/wizard): AI-guided encryption setup (reads your codebase)
- [Configuration](https://cipherstash.com/docs/reference/proxy/configuration): Install and configure CipherStash Proxy: Docker, TOML and environment variables, logging, Prometheus metrics, and the CLI.
- [Errors](https://cipherstash.com/docs/reference/proxy/errors): Errors returned by CipherStash Proxy, grouped by category, with likely causes and steps to diagnose and resolve each one.
- [Proxy](https://cipherstash.com/docs/reference/proxy): Configuration, message flow, multitenant operation, and error reference for CipherStash Proxy.
- [Message flow](https://cipherstash.com/docs/reference/proxy/message-flow): How CipherStash Proxy handles PostgreSQL Parse and Bind messages to transparently encrypt and decrypt query parameters.
- [Multitenant operation](https://cipherstash.com/docs/reference/proxy/multitenant): Scope CipherStash Proxy connections to tenant-specific keysets and manage encrypted mapping at runtime.
- [Overview](https://cipherstash.com/docs/reference/stack): The core @cipherstash/stack package for client-side encryption, searchable schemas, identity controls, and encrypted query operands.
- [Usage](https://cipherstash.com/docs/reference/stack/usage): Install @cipherstash/stack and use its core encryption client with an EQL v3 encrypted column.
- [Billing](https://cipherstash.com/docs/reference/workspace/billing): How CipherStash per-workspace billing works, including plans, upgrades, downgrades, and Stripe.
- [Configuration](https://cipherstash.com/docs/reference/workspace/configuration): Configure a CipherStash workspace for local development and production: the workspace CRN, client and access keys, and keyset selection.
- [Workspace & account](https://cipherstash.com/docs/reference/workspace): Workspace configuration, organization and workspace members, and per-workspace billing.
- [Members](https://cipherstash.com/docs/reference/workspace/members): Manage CipherStash organization members and workspace memberships, and onboard developer devices for local development.
- [@cipherstash/stack-drizzle](https://cipherstash.com/docs/integrations/drizzle/api-reference): API reference for @cipherstash/stack-drizzle: every exported type, function, and class, with signatures, parameters, and usage.
- [codec-types](https://cipherstash.com/docs/integrations/prisma/api-reference/codec-types): codec-types is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.
- [column-types](https://cipherstash.com/docs/integrations/prisma/api-reference/column-types): column-types is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.
- [control](https://cipherstash.com/docs/integrations/prisma/api-reference/control): control is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.
- [@cipherstash/stack-prisma](https://cipherstash.com/docs/integrations/prisma/api-reference): API reference for @cipherstash/stack-prisma: every exported type, function, and class, with signatures, parameters, and usage.
- [operation-types](https://cipherstash.com/docs/integrations/prisma/api-reference/operation-types): operation-types is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.
- [pack](https://cipherstash.com/docs/integrations/prisma/api-reference/pack): pack is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.
- [runtime](https://cipherstash.com/docs/integrations/prisma/api-reference/runtime): runtime is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.
- [stack](https://cipherstash.com/docs/integrations/prisma/api-reference/stack): stack is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.
- [v3](https://cipherstash.com/docs/integrations/prisma/api-reference/v3): v3 is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.
- [@cipherstash/stack-supabase](https://cipherstash.com/docs/integrations/supabase/api-reference): API reference for @cipherstash/stack-supabase: every exported type, function, and class, with signatures, parameters, and usage.
- [EQL v2](https://cipherstash.com/docs/reference/eql/v2): PostgreSQL types, operators, and functions for querying encrypted data with EQL v2 (v2.2) — the eql_v2_encrypted type and searchable index types.
- [Setting up indexes](https://cipherstash.com/docs/reference/eql/v2/indexes): Create PostgreSQL indexes for encrypted columns. Index syntax differs between self-hosted PostgreSQL and managed databases like Supabase.
- [The CipherCell](https://cipherstash.com/docs/reference/eql/v2/payload): Understand the CipherCell, the CipherStash JSON format that stores ciphertext, searchable encrypted metadata, and fields for querying encrypted data via EQL.
- [Searchable encryption queries](https://cipherstash.com/docs/reference/eql/v2/queries): Equality, match, and range query patterns for encrypted PostgreSQL columns, with SDK predicates and raw SQL forms.
- [Package exports](https://cipherstash.com/docs/reference/stack/api-reference/Package-exports): Exports available from the `@cipherstash/stack` package root. Package exports in the @cipherstash/stack TypeScript API reference.
- [adapter-kit](https://cipherstash.com/docs/reference/stack/api-reference/adapter-kit): adapter-kit is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [dynamodb](https://cipherstash.com/docs/reference/stack/api-reference/dynamodb): dynamodb is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [encryption](https://cipherstash.com/docs/reference/stack/api-reference/encryption): encryption is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [encryption/v3](https://cipherstash.com/docs/reference/stack/api-reference/encryption.v3): encryption/v3 is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [eql/v3](https://cipherstash.com/docs/reference/stack/api-reference/eql.v3): eql/v3 is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [errors](https://cipherstash.com/docs/reference/stack/api-reference/errors): errors is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [identity](https://cipherstash.com/docs/reference/stack/api-reference/identity): identity is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [@cipherstash/stack](https://cipherstash.com/docs/reference/stack/api-reference): API reference for @cipherstash/stack: every exported type, function, and class, with signatures, parameters, and usage.
- [schema](https://cipherstash.com/docs/reference/stack/api-reference/schema): schema is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [types-public](https://cipherstash.com/docs/reference/stack/api-reference/types-public): types-public is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [wasm-inline](https://cipherstash.com/docs/reference/stack/api-reference/wasm-inline): wasm-inline is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
- [CipherStash Documentation](https://cipherstash.com/docs/stack): Data Level Access Control for Postgres. Searchable field-level encryption, identity-bound keys, cryptographic audit trails.
- [Quickstart](https://cipherstash.com/docs/stack/quickstart): Encrypt, store, query, and decrypt your first fields in any Postgres using the stash CLI and @cipherstash/stack, with field-level keys and ZeroKMS.
- [CipherStash](https://cipherstash.com/docs/stack/cipherstash): Data Level Access Control for Postgres. Searchable field-level encryption, identity-bound keys, cryptographic audit trails.
- [PostgreSQL](https://cipherstash.com/docs/stack/cipherstash/postgres): CipherStash integration options for PostgreSQL databases. Choose the right path based on your ORM, deployment, and how much application control you need.
- [Supabase](https://cipherstash.com/docs/stack/cipherstash/supabase): Field-level encryption for your Supabase project. Works with any Postgres client, the Supabase JS SDK, or Drizzle ORM.
- [Deploying to AWS ECS](https://cipherstash.com/docs/stack/deploy/aws-ecs): Deploy CipherStash Proxy to AWS ECS on Fargate, covering ECR images, Secrets Manager credentials, IAM roles, task definitions, and an RDS connection.
- [Bundling](https://cipherstash.com/docs/stack/deploy/bundling): Configure webpack, esbuild, Next.js, and SST to exclude the native @cipherstash/stack module from bundling, plus fixes for Linux deployment failures.
- [Going to production](https://cipherstash.com/docs/stack/deploy/going-to-production): Transition from local device-based auth to production environment variables for CI/CD and hosting platforms
- [Deploy](https://cipherstash.com/docs/stack/deploy): Go from local dev to production. Environment variables, team setup, bundling, and deployment guides.
- [SST](https://cipherstash.com/docs/stack/deploy/sst): Configure SST serverless functions for @cipherstash/stack by excluding it from esbuild bundling and installing it into the Lambda deployment artifact.
- [Team onboarding](https://cipherstash.com/docs/stack/deploy/team-onboarding): Invite team members and set up per-developer device-based access to CipherStash, with traceable client keys you can grant and revoke individually.
- [Testing](https://cipherstash.com/docs/stack/deploy/testing): Test applications using @cipherstash/stack encryption with a dedicated workspace or mocked client, plus PostgreSQL integration tests and CI setup.
- [Troubleshooting](https://cipherstash.com/docs/stack/deploy/troubleshooting): Diagnose @cipherstash/stack issues including client init failures, decryption and keyset errors, empty search results, native addon loading, and performance.
- [Agent Skills](https://cipherstash.com/docs/stack/reference/agent-skills): Install CipherStash agent skills to give your AI coding assistant accurate knowledge of encryption setup, schema building, and integrations
- [Billing](https://cipherstash.com/docs/stack/reference/billing): Understand CipherStash per-workspace billing, compare Free, Pro, Business, and Enterprise plan limits, and learn how upgrades, downgrades, and Stripe work.
- [The CipherCell](https://cipherstash.com/docs/stack/reference/cipher-cell): Understand the CipherCell, the CipherStash JSON format that stores ciphertext, searchable encrypted metadata, and fields for querying encrypted data via EQL.
- [Compliance](https://cipherstash.com/docs/stack/reference/compliance): See how CipherStash supports SOC 2, HIPAA, GDPR, PCI-DSS, and more through field-level encryption, data residency, audit logging, and crypto-shredding.
- [Supabase dashboard integration](https://cipherstash.com/docs/stack/reference/dashboard-supabase-integration): Connect Supabase from the CipherStash dashboard, verify EQL readiness, configure OIDC, and install from the Supabase Marketplace.
- [Discovery session](https://cipherstash.com/docs/stack/reference/discovery-session): What to prepare before your first conversation with the CipherStash team, and what to expect during the call.
- [Drizzle adapter reference](https://cipherstash.com/docs/stack/reference/drizzle): Encrypted query operators, schema extraction, EQL migration generation, and API surface for @cipherstash/stack/drizzle.
- [Encryption SDK reference](https://cipherstash.com/docs/stack/reference/encryption-sdk): Public entry points, supported data types, and configuration highlights for @cipherstash/stack field-level encryption.
- [Encrypt Query Language (EQL)](https://cipherstash.com/docs/stack/reference/eql-guide): Learn how EQL adds PostgreSQL types, operators, and functions for querying encrypted data, covering the eql_v2_encrypted type and searchable index types.
- [Error handling](https://cipherstash.com/docs/stack/reference/error-handling): Handle errors in the @cipherstash/stack SDK with the Result pattern, covering error types, initialization failures, bulk operations, and identity issues.
- [Glossary](https://cipherstash.com/docs/stack/reference/glossary): Definitions of key CipherStash concepts and terms, from ZeroKMS, keysets, and client keys to EQL, HMAC, and searchable encryption.
- [API Reference](https://cipherstash.com/docs/stack/reference): Browse the CipherStash API reference, including the @cipherstash/stack SDK with Encryption, plus types, operators, and functions.
- [Members](https://cipherstash.com/docs/stack/reference/members): Manage CipherStash organization members and workspace memberships in the Dashboard, and onboard developer devices with stash init for local development.
- [Migration guide](https://cipherstash.com/docs/stack/reference/migration): Migrate from @cipherstash/protect to @cipherstash/stack with mapped imports, renamed functions, and updated schema definitions in a few simple steps.
- [Planning guide](https://cipherstash.com/docs/stack/reference/planning-guide): Plan a CipherStash encryption-in-use integration by comparing encryption types, integration paths, ZeroKMS architecture, and the path from dev to production.
- [Error reference](https://cipherstash.com/docs/stack/reference/proxy-errors): A complete reference for errors returned by CipherStash Proxy, grouped by category, with likely causes and steps to diagnose and resolve each one.
- [Reference](https://cipherstash.com/docs/stack/reference/proxy-reference): Complete configuration reference for CipherStash Proxy, covering TOML and environment variable options, CLI flags, Prometheus metrics, and log levels.
- [Security architecture](https://cipherstash.com/docs/stack/reference/security-architecture): Understand the CipherStash security architecture, covering cryptographic primitives, the ZeroKMS key hierarchy, zero-knowledge trust model, and data flow.
- [Supported solutions](https://cipherstash.com/docs/stack/reference/supported-solutions): Integration options, supported databases, and performance characteristics for CipherStash encryption
- [What is CipherStash?](https://cipherstash.com/docs/stack/reference/what-is-cipherstash): Data Level Access Control. Searchable field-level encryption, identity-bound keys, and cryptographic audit trails for Postgres.
- [Bulk operations](https://cipherstash.com/docs/stack/cipherstash/encryption/bulk-operations): Encrypt and decrypt arrays of raw values in a single ZeroKMS round-trip using bulkEncrypt and bulkDecrypt
- [Configuration](https://cipherstash.com/docs/stack/cipherstash/encryption/configuration): Configure the @cipherstash/stack encryption SDK with environment variables or programmatic config, covering credentials, keysets, logging, and bundlers.
- [Drizzle ORM](https://cipherstash.com/docs/stack/cipherstash/encryption/drizzle): Define encrypted columns and run type-safe queries with Drizzle ORM and @cipherstash/stack, covering equality, range, text search, and JSONB operators.
- [DynamoDB](https://cipherstash.com/docs/stack/cipherstash/encryption/dynamodb): Encrypt and decrypt DynamoDB items with the encryptedDynamoDB helper from @cipherstash/stack, including bulk operations and HMAC equality queries.
- [Encrypt and decrypt](https://cipherstash.com/docs/stack/cipherstash/encryption/encrypt-decrypt): Encrypt and decrypt single values, models, and bulk records with the CipherStash Encryption SDK, plus identity-aware lock contexts and audit logging.
- [Identity-aware encryption](https://cipherstash.com/docs/stack/cipherstash/encryption/identity): Authenticate as the end user with OidcFederationStrategy and bind encryption to a JWT claim with withLockContext, so only that identity can decrypt their data.
- [/ENCRYPTION](https://cipherstash.com/docs/stack/cipherstash/encryption): Searchable field-level encryption. Range queries, exact match, and free-text search over ciphertext with sub-millisecond overhead.
- [Setting up indexes](https://cipherstash.com/docs/stack/cipherstash/encryption/indexes): Create PostgreSQL indexes for encrypted columns. Index syntax differs between self-hosted PostgreSQL and managed databases like Supabase.
- [Model operations](https://cipherstash.com/docs/stack/cipherstash/encryption/models): Encrypt and decrypt entire records with schema-driven field selection using encryptModel, decryptModel, bulkEncryptModels, and bulkDecryptModels
- [Prisma Next](https://cipherstash.com/docs/stack/cipherstash/encryption/prisma-next): Searchable field-level encryption for Postgres with Prisma Next, the next-gen ORM with a built-in migration framework
- [Searchable encryption queries](https://cipherstash.com/docs/stack/cipherstash/encryption/queries): Equality, match, and range query patterns for encrypted PostgreSQL columns, with SDK predicates and raw SQL forms.
- [Schema definition](https://cipherstash.com/docs/stack/cipherstash/encryption/schema): Define a @cipherstash/stack schema with encryptedTable and encryptedColumn to choose columns to encrypt, index types, data types, and nested fields.
- [Searchable encryption](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption): Query encrypted data without decryption. Equality, free-text search, range, ordering, and JSON queries over ciphertext in PostgreSQL.
- [Storing encrypted data](https://cipherstash.com/docs/stack/cipherstash/encryption/storing-data): Store and retrieve encrypted data in PostgreSQL with the @cipherstash/stack Encryption SDK using raw SQL, jsonb or eql_v2_encrypted columns, and bulk ops.
- [Supabase](https://cipherstash.com/docs/stack/cipherstash/encryption/supabase): Encrypt, search, and decrypt data with the encryptedSupabase wrapper from @cipherstash/stack, using familiar Supabase queries, filters, and inserts.
- [Access keys](https://cipherstash.com/docs/stack/cipherstash/kms/access-keys): Create and manage CipherStash access keys for programmatic access to CipherStash Services like ZeroKMS, with member, control, and admin roles and their available scopes.
- [Client keys](https://cipherstash.com/docs/stack/cipherstash/kms/clients): Create and manage CipherStash client keys for SDKs and Proxy, covering device-backed keys for local development and application keys for production and CI.
- [Configuration](https://cipherstash.com/docs/stack/cipherstash/kms/configuration): Configure ZeroKMS for local development and production, including workspace CRN, client and access keys, and keysets for multi-tenant key isolation.
- [CipherStash Token Service (CTS)](https://cipherstash.com/docs/stack/cipherstash/kms/cts): Learn how the CipherStash Token Service (CTS) issues temporary tokens for ZeroKMS access via IDP federation with Auth0, Okta, Clerk, or access keys.
- [Disaster recovery](https://cipherstash.com/docs/stack/cipherstash/kms/disaster-recovery): How ZeroKMS keeps encrypted data recoverable through disaster recovery, separating keys from data so regional outages cause no data loss.
- [ZeroKMS](https://cipherstash.com/docs/stack/cipherstash/kms): 100x faster key management. Unique key per value, derived on demand, never stored. Backed by AWS KMS.
- [Keysets](https://cipherstash.com/docs/stack/cipherstash/kms/keysets): Use CipherStash keysets with ZeroKMS to derive unique data keys and cryptographically isolate tenants, environments, and custom boundaries in your app.
- [OIDC Providers](https://cipherstash.com/docs/stack/cipherstash/kms/oidc): Register an identity provider so end users can authenticate cryptographic operations with their own identity tokens
- [Regions](https://cipherstash.com/docs/stack/cipherstash/kms/regions): Review the AWS regions where ZeroKMS is deployed for CipherStash workspaces, spanning the US, Europe, and Asia Pacific, plus how to request a new region.
- [Audit features](https://cipherstash.com/docs/stack/cipherstash/proxy/audit): Statement fingerprinting, SQL redaction, primary key injection, and record reconciliation in CipherStash Proxy
- [Configuration](https://cipherstash.com/docs/stack/cipherstash/proxy/configuration): Installing and configuring CipherStash Proxy for Docker, environment variables, and database schema setup
- [Encrypt tool](https://cipherstash.com/docs/stack/cipherstash/proxy/encrypt-tool): Use the encrypt CLI tool to encrypt existing data or apply index changes after updating CipherStash Proxy encryption configuration.
- [Getting started with Proxy](https://cipherstash.com/docs/stack/cipherstash/proxy/getting-started): Run CipherStash Proxy locally with Docker and set up credentials, then insert, query, and search transparently encrypted PostgreSQL data in minutes.
- [/PROXY](https://cipherstash.com/docs/stack/cipherstash/proxy): CipherStash Proxy adds transparent, searchable encryption to existing PostgreSQL databases with zero application code changes, powered by EQL and ZeroKMS.
- [Message flow](https://cipherstash.com/docs/stack/cipherstash/proxy/message-flow): How CipherStash Proxy handles PostgreSQL Parse and Bind messages to transparently encrypt and decrypt query parameters.
- [Multitenant operation](https://cipherstash.com/docs/stack/cipherstash/proxy/multitenant): Scope CipherStash Proxy connections to tenant-specific keysets and manage encrypted mapping at runtime.
- [Searchable JSON functions and operators](https://cipherstash.com/docs/stack/cipherstash/proxy/searchable-json): Query encrypted JSONB through CipherStash Proxy using supported operators, path functions, and the ste_vec index, with setup and known limitations.
- [Troubleshooting](https://cipherstash.com/docs/stack/cipherstash/proxy/troubleshooting): Diagnose and resolve issues with CipherStash Proxy, including ZeroKMS connection problems and slow statement performance.
- [Programmatic API](https://cipherstash.com/docs/stack/cipherstash/cli/api): Import the stash package programmatically to install EQL, load and validate stash.config.ts, and build custom CipherStash tooling or CI scripts.
- [Execute an encryption plan](https://cipherstash.com/docs/stack/cipherstash/cli/impl): Run stash impl to execute your CipherStash encryption plan by handing off to a coding agent such as Claude Code, Codex, or AGENTS.md.
- [CipherStash CLI](https://cipherstash.com/docs/stack/cipherstash/cli): The stash dev-time CLI installs EQL in PostgreSQL, scaffolds an encryption client, and manages schemas with init, plan, and impl commands.
- [Interactive setup](https://cipherstash.com/docs/stack/cipherstash/cli/init): Run stash init to authenticate, resolve your database, scaffold an encryption client, install dependencies, and add the EQL extension to CipherStash.
- [Install and upgrade EQL](https://cipherstash.com/docs/stack/cipherstash/cli/install): Install or upgrade EQL extensions in Postgres with the stash CLI, covering Supabase and Drizzle migrations, auto-detection, and permission fallbacks.
- [Draft an encryption plan](https://cipherstash.com/docs/stack/cipherstash/cli/plan): Run stash plan to hand off to a coding agent that drafts a reviewable encryption plan.md, with column paths, before any code changes are made.
- [Push and status](https://cipherstash.com/docs/stack/cipherstash/cli/push): Push your CipherStash encryption schema to PostgreSQL and use db status and test-connection to check EQL installation and database connectivity.
- [Project status](https://cipherstash.com/docs/stack/cipherstash/cli/status): Run stash status for a fast, read-only view of your CipherStash setup lifecycle, reading disk state only with no network, database, or auth.
- [Troubleshooting](https://cipherstash.com/docs/stack/cipherstash/cli/troubleshooting): Fix common CipherStash CLI errors covering config files, database permissions, EQL installs, Supabase resets, and Drizzle migration issues.
- [Schema validation](https://cipherstash.com/docs/stack/cipherstash/cli/validate): Use stash db validate to check your CipherStash encryption schema for misconfigurations, with rules for search types, indexes, and operator families.
- [CipherStash vs AWS KMS](https://cipherstash.com/docs/stack/reference/comparisons/aws-kms): Compare CipherStash Encryption and AWS KMS for application-level encryption, covering searchable encryption, bulk operations, and developer experience.
- [CipherStash vs Homomorphic Encryption](https://cipherstash.com/docs/stack/reference/comparisons/fhe): Searchable encryption is not FHE. See how CipherStash queries encrypted data and why it's far faster than fully homomorphic encryption for real workloads.
- [Overview](https://cipherstash.com/docs/stack/reference/comparisons): How CipherStash compares to alternative approaches — homomorphic encryption, KMS-only architectures, data vaults.
- [EQL API Reference](https://cipherstash.com/docs/stack/reference/eql): Complete API reference for the Encrypt Query Language (EQL) PostgreSQL extension.
- [Securing AI and RAG pipelines](https://cipherstash.com/docs/stack/reference/use-cases/ai-rag): Protect sensitive data in AI retrieval-augmented generation pipelines with encrypted vector storage and searchable encryption
- [Regulatory compliance](https://cipherstash.com/docs/stack/reference/use-cases/compliance): Meet GDPR, HIPAA, and PCI-DSS requirements with encrypted uniqueness constraints, data minimization, and audit trails
- [Data residency](https://cipherstash.com/docs/stack/reference/use-cases/data-residency): Meet data residency rules with CipherStash using regional ZeroKMS deployment, a dual-party key split, and multi-region patterns for cross-border access.
- [Overview](https://cipherstash.com/docs/stack/reference/use-cases): Real-world use cases for CipherStash encryption, including data vault comparisons, data sovereignty, and identifying sensitive data
- [Provable access control](https://cipherstash.com/docs/stack/reference/use-cases/provable-access): Cryptographic proof-based access control with Lock Contexts for identity-aware encryption and audit logging