Notes
18 entries · Updated 2026-10-13
- Subject
- Questions we hear on sales calls
- Kept by
- CipherStash
Notes are shorter and rougher than the blog, and they are AI-first. Each one starts as an objection raised on a sales call or in a security review. We draft the note with AI from the transcript of that call, and we check every one before it goes up. The note states the question, answers it in the first paragraph, says which part of the objection is true, and links to the docs that back the answer up.
- 2026
Can we keep EU data in the EU?
Yes, if your application runs in the EU as well. A workspace is bound to one ZeroKMS region, Frankfurt or Ireland for the EU. Encryption runs in your infrastructure, ciphertext lives in your database, and the authority key does not leave the region.
CipherStash Team
Can you prove who read what?
Every decryption goes through ZeroKMS, and ZeroKMS records the operation before it returns the key material. The record names the identity, the keyset, the application and the time.
CipherStash Team
Can you see our data?
No. A data key needs an authority key held in ZeroKMS and a client key held by you. We have one of them, and plaintext never leaves your process.
CipherStash Team
Did you roll your own crypto?
No. Four documented schemes built on open-source primitives, and you can read the source for every one of them today. EQL is open source. The SDK core and the ORE implementations are source-available.
CipherStash Team
Do we have to put a proxy in front of our database?
No. The default is the Stack SDK in your application, on the Postgres connection you already have. Proxy is the alternative for applications you cannot change.
CipherStash Team
Do you have an SDK for our language?
TypeScript on Node, Deno, Supabase Edge Functions, Workers and Bun. Not the browser. For any other language, Proxy speaks the Postgres wire protocol.
CipherStash Team
Does this make us SOC 2 or HIPAA compliant?
No product does. What it gives you is control implementations and evidence for the encryption, key access, tenant isolation, access attribution and residency parts of an audit.
CipherStash Team
How do we migrate the data we already have?
Add an encrypted mirror column, dual-write, backfill with the CLI, move reads over, then drop the plaintext. The plaintext column stays authoritative until the last step, so every stage before it is reversible.
CipherStash Team
How much slower will our queries be?
On the indexed paths, within 1.2 to 1.4 times plaintext at about 0.12 ms, flat from 10 thousand to 10 million rows. Free-text is about 16 ms. Decrypting a page adds one ZeroKMS request.
CipherStash Team
If it's searchable, how encrypted is it really?
Less than an opaque blob. Each search term reveals something specific, and the docs list what. Search is optional per column, and a column without it reveals nothing beyond the ciphertext.
CipherStash Team
Is there a network call every time we read a row?
One per operation, and a bulk operation shares it. Every KMS needs a network call for key material. ZeroKMS batches, so a page of rows is one request, up to 500 values by default.
CipherStash Team
Is this Postgres only?
For searchable encryption, yes. Any Postgres you can connect to, no extension and no superuser. DynamoDB gets equality lookups. Everything else gets encryption without server-side queries.
CipherStash Team
Our agent already has a database user with the right grants. Why isn't that enough?
Because the database user identifies the agent's workload, not the person it is acting for. Make requests as the signed-in user and lock values to them, and the agent can decrypt those values only on that user's behalf.
CipherStash Team
We already have Auth0 and row-level security. What does this add?
A layer below them. Once a query is allowed, the database returns plaintext. CipherStash decides whether a value can become plaintext, and for whom, inside the key derivation.
CipherStash Team
We don't need to search encrypted data. Why would we need you?
Most teams don't, and search is optional per column. CipherStash is for data-level access control, and that works with search switched off everywhere.
CipherStash Team
What can we still query once it's encrypted?
Equality, text match, ordering and range, and JSON paths, each with an index type you opt into per column. Not arithmetic aggregates, not regex, not LIKE.
CipherStash Team
What happens to our data if you go out of business?
You decrypt it and leave, at no cost from us. Decryption needs ZeroKMS, so plan it inside your notice period. Enterprise agreements can add a guaranteed wind-down period and source code escrow.
CipherStash Team
Why wouldn't we just build this ourselves with KMS and a hash column?
You could, and on the licence line it is cheaper. What you would then own is key management, rotation, audit, the production migration, and the cloud KMS bill that per-value keys generate.
CipherStash Team
End of notes