Do we have to put a proxy in front of our database?
- Date
- By
- CipherStash Team
No. The default is the Stack SDK: encryption runs in your application, and the app talks to Postgres over the connection it already has. Nothing new sits in the query path. Proxy is the alternative, for applications you cannot change.
The default
Install the Stack SDK, declare which columns are encrypted, and the SDK encrypts values before they leave your process and writes EQL types that Postgres stores and indexes. Your application connects to Postgres the way it does today. Same connection string, same pooler, same replication. CipherStash does not proxy that connection.
When Proxy is the right call
When you cannot or will not change the application. Point the existing Postgres connection at Proxy and it maps SQL statements to EQL for you, so the application code stays as it is. Both paths produce the same ciphertext and both speak EQL, so a table encrypted through one can be read through the other. You can start with Proxy on a legacy service and move it to the SDK later without re-encrypting.
Proxy compatibility
Proxy works alongside connection poolers, but where the pooler sits matters. We have not yet published a compatibility matrix, so if a specific pooler or ORM is a hard requirement, tell us and we will test your topology.