Proxy

CipherStash Proxy sits between your application and PostgreSQL, encrypting query parameters on the way in and decrypting results on the way out. Your application connects to Proxy exactly as it connects to PostgreSQL, so adopting encryption needs no application changes.

Proxy speaks the PostgreSQL wire protocol (it is based on pgcat) and is distributed as a container image on Docker Hub. It is an EQL client: it produces the encrypted payloads EQL stores, and types the bound parameters EQL's operators resolve against.

In this section

• Configuration covers installation, the TOML and environment-variable options, logging, Prometheus metrics, and the CLI.
• Message flow explains how Proxy intercepts the extended query protocol, for debugging unmappable statements.
• Multitenant operation covers per-connection keyset scoping and encrypted mapping.
• Errors lists the errors Proxy returns, with causes and remediation.

Related

• EQL reference for the database-side surface Proxy queries against.
• Stack SDK for the application-level alternative to Proxy.