# Do we have to put a proxy in front of our database?

*Published on 2026-10-13T00:00:00.000Z*

*By CipherStash Team*

No. The default is the Stack SDK: encryption runs in your application, and the app talks to Postgres over the connection it already has. Nothing new sits in the query path. Proxy is the alternative, for applications you cannot change.

## Content

## The default

Install the Stack SDK, declare which columns are encrypted, and the SDK encrypts values before they leave your process and writes EQL types that Postgres stores and indexes. Your application connects to Postgres the way it does today. Same connection string, same pooler, same replication. CipherStash does not proxy that connection.

## When Proxy is the right call

When you cannot or will not change the application. Point the existing Postgres connection at Proxy and it maps SQL statements to EQL for you, so the application code stays as it is. Both paths produce the same ciphertext and both speak EQL, so a table encrypted through one can be read through the other. You can start with Proxy on a legacy service and move it to the SDK later without re-encrypting.

## Proxy compatibility

Proxy works alongside connection poolers, but where the pooler sits matters. We have not yet published a compatibility matrix, so if a specific pooler or ORM is a hard requirement, tell us and we will test your topology.

## Technical evidence

- [Choose your stack: SDK or Proxy](/docs/get-started/choose-your-stack)
- [What is CipherStash: how the pieces fit](/docs/get-started/what-is-cipherstash)
- [Proxy reference](/docs/reference/proxy)

## Related notes

- [Is there a network call every time we read a row?](https://cipherstash.com/notes/is-there-a-network-call-every-time-we-read-a-row.md) — One per operation, and a bulk operation shares it. Every KMS needs a network call for key material. ZeroKMS batches, so a page of rows is one request, up to 500 values by default.
- [Why wouldn't we just build this ourselves with KMS and a hash column?](https://cipherstash.com/notes/why-not-build-this-ourselves.md) — You could, and on the licence line it is cheaper. What you would then own is key management, rotation, audit, the production migration, and the cloud KMS bill that per-value keys generate.