# Notes Answers to the questions engineers, security reviewers, and buyers ask about CipherStash. Each note states the question, answers it in the first paragraph, says which part of the objection is true, and links to the docs that back the answer up. ## [Can we keep EU data in the EU?](https://cipherstash.com/notes/can-we-keep-eu-data-in-the-eu.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* Yes, if your application runs in the EU as well. A workspace is bound to one ZeroKMS region, Frankfurt or Ireland for the EU. Encryption runs in your infrastructure, ciphertext lives in your database, and the authority key does not leave the region. --- ## [Can you prove who read what?](https://cipherstash.com/notes/can-you-prove-who-read-what.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* Every decryption goes through ZeroKMS, and ZeroKMS records the operation before it returns the key material. The record names the identity, the keyset, the application and the time. --- ## [Can you see our data?](https://cipherstash.com/notes/can-you-see-our-data.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* No. A data key needs an authority key held in ZeroKMS and a client key held by you. We have one of them, and plaintext never leaves your process. --- ## [Did you roll your own crypto?](https://cipherstash.com/notes/did-you-roll-your-own-crypto.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* No. Four documented schemes built on open-source primitives, and you can read the source for every one of them today. EQL is open source. The SDK core and the ORE implementations are source-available. --- ## [Do we have to put a proxy in front of our database?](https://cipherstash.com/notes/do-we-have-to-put-a-proxy-in-front-of-our-database.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* No. The default is the Stack SDK in your application, on the Postgres connection you already have. Proxy is the alternative for applications you cannot change. --- ## [Do you have an SDK for our language?](https://cipherstash.com/notes/do-you-have-an-sdk-for-our-language.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* TypeScript on Node, Deno, Supabase Edge Functions, Workers and Bun. Not the browser. For any other language, Proxy speaks the Postgres wire protocol. --- ## [Does this make us SOC 2 or HIPAA compliant?](https://cipherstash.com/notes/does-this-make-us-soc-2-or-hipaa-compliant.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* No product does. What it gives you is control implementations and evidence for the encryption, key access, tenant isolation, access attribution and residency parts of an audit. --- ## [How do we migrate the data we already have?](https://cipherstash.com/notes/how-do-we-migrate-the-data-we-already-have.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* Add an encrypted mirror column, dual-write, backfill with the CLI, move reads over, then drop the plaintext. The plaintext column stays authoritative until the last step, so every stage before it is reversible. --- ## [How much slower will our queries be?](https://cipherstash.com/notes/how-much-slower-will-our-queries-be.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* On the indexed paths, within 1.2 to 1.4 times plaintext at about 0.12 ms, flat from 10 thousand to 10 million rows. Free-text is about 16 ms. Decrypting a page adds one ZeroKMS request. --- ## [If it's searchable, how encrypted is it really?](https://cipherstash.com/notes/if-its-searchable-how-encrypted-is-it-really.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* Less than an opaque blob. Each search term reveals something specific, and the docs list what. Search is optional per column, and a column without it reveals nothing beyond the ciphertext. --- ## [Is there a network call every time we read a row?](https://cipherstash.com/notes/is-there-a-network-call-every-time-we-read-a-row.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* One per operation, and a bulk operation shares it. Every KMS needs a network call for key material. ZeroKMS batches, so a page of rows is one request, up to 500 values by default. --- ## [Is this Postgres only?](https://cipherstash.com/notes/is-this-postgres-only.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* For searchable encryption, yes. Any Postgres you can connect to, no extension and no superuser. DynamoDB gets equality lookups. Everything else gets encryption without server-side queries. --- ## [Our agent already has a database user with the right grants. Why isn't that enough?](https://cipherstash.com/notes/our-agent-already-has-a-database-user.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* Because the database user identifies the agent's workload, not the person it is acting for. Make requests as the signed-in user and lock values to them, and the agent can decrypt those values only on that user's behalf. --- ## [We already have Auth0 and row-level security. What does this add?](https://cipherstash.com/notes/we-already-have-auth0-and-row-level-security.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* A layer below them. Once a query is allowed, the database returns plaintext. CipherStash decides whether a value can become plaintext, and for whom, inside the key derivation. --- ## [We don't need to search encrypted data. Why would we need you?](https://cipherstash.com/notes/we-dont-need-to-search-encrypted-data.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* Most teams don't, and search is optional per column. CipherStash is for data-level access control, and that works with search switched off everywhere. --- ## [What can we still query once it's encrypted?](https://cipherstash.com/notes/what-can-we-still-query-once-its-encrypted.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* Equality, text match, ordering and range, and JSON paths, each with an index type you opt into per column. Not arithmetic aggregates, not regex, not LIKE. --- ## [What happens to our data if you go out of business?](https://cipherstash.com/notes/what-happens-if-you-go-out-of-business.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* You decrypt it and leave, at no cost from us. Decryption needs ZeroKMS, so plan it inside your notice period. Enterprise agreements can add a guaranteed wind-down period and source code escrow. --- ## [Why wouldn't we just build this ourselves with KMS and a hash column?](https://cipherstash.com/notes/why-not-build-this-ourselves.md) *Published on 2026-10-13T00:00:00.000Z* — *CipherStash Team* You could, and on the licence line it is cheaper. What you would then own is key management, rotation, audit, the production migration, and the cloud KMS bill that per-value keys generate. ---