Solutions

CipherStash encrypts sensitive data at the field level, in your infrastructure, while keeping it queryable. This section covers the problems that solves, and what an implementation looks like for each.

In this section

• Data residency covers regional key management and the deployment patterns for cross-border requirements.
• Provable access control binds decryption to an authenticated identity, so access is cryptographically demonstrable rather than merely logged.

What data should I protect?

When improving your data security practices, it can be difficult to know what data is important enough to protect. These are the common categories of sensitive data worth encrypting.

Personally identifiable information (PII)

Any data that could identify a specific individual: names, phone numbers, dates of birth, addresses, emails, IP addresses, social security numbers, license numbers, passport numbers.

Applicable regulations: GDPR, CCPA, HIPAA, APP (Australia), PCI-DSS, SOC 2, ISO 27001.

Protected health information (PHI)

Any information about health status, provision of health care, or payment for health care that can be linked to an individual: medical record numbers, health insurance beneficiary numbers, biometric identifiers, medical conditions, medication histories, payment histories.

Applicable regulations: HIPAA, CMIA, GDPR, APP.

Financial information

Data about money, accounts, and transactions: account numbers and balances, transaction data, TFNs and ITINs, saved payees.

Applicable regulations: GDPR, CCPA, PCI-DSS, CDR (Australia), SOC 2, ISO 27001.

Authentication information

Credentials used to gain access to accounts and services: usernames, passwords (both plaintext and hashed), OAuth tokens, session cookies.

Applicable regulations: SOC 2, ISO 27001, PCI-DSS.

Related

• Searchable encryption for how querying encrypted data works, and what each index term reveals.
• Compliance for how CipherStash maps onto specific frameworks.