§ 00·0x00/PRISMA + CIPHERSTASH

BUILT FOR PRISMA 8

Search encrypted data with Prisma.

Encrypt customer records, financial data, and AI application data at the field level, and keep the queries that make Prisma useful. Lookups, free-text search, sorting, and range queries all run on ciphertext. The CipherStash extension is available now in Prisma 8 RC1.

GET STARTED WITH PRISMA MORE ON PRISMA 8

10K operations/month freeNo credit card requiredWorks with existing Prisma apps

schema.prisma

model User {  id          String @id  email       cipherstash.TextSearch()  // searchable encrypted string  birthday    cipherstash.Date()        // encrypted Date  preferences cipherstash.Json()        // encrypted JSON}

§ 01·0x01/THE CONTRACT

Encryption in the data contract.

Prisma 8 uses a contract-first workflow. Your data contract describes the state of your database, and the framework plans, applies, and verifies the migrations to produce it.

The CipherStash extension makes encryption part of that same contract. Instead of String or Int, use cipherstash types for sensitive fields. Searchable variants like TextSearch enable sorting, lookups, and fuzzy text search on encrypted values. The contract is the single source of truth for which fields are encrypted and how they can be queried.

Encrypting a field is a one-line change. Prisma 8 handles the column types, the database extension, and the searchable indexes in the next migration.

schema.prisma (before)

model Customer {  id    String @id  name  String  email String}

schema.prisma (after)

model Customer {  id    String @id  name  cipherstash.TextSearch()  email cipherstash.TextSearch()}

§ 02·0x02/QUERIES

Encrypted queries that look like Prisma queries.

Queries use type-safe operator functions provided by the extension. No query rewrites, no shadow tables, no decrypt-first workarounds. The query term is encrypted inside the application. PostgreSQL compares encrypted query terms against encrypted values, and the plaintext never reaches the database.

Equality lookups, free-text search, range queries, sorting, and queries over encrypted JSON are all supported. Standard B-tree and GIN indexes work, so many queries are sub-millisecond even on very large datasets.

find-user.ts

// Equality: find a customer by exact email address.// The query term is encrypted in the application.// Plaintext never reaches the database.const customers = await db.orm.Customer  .where(c => c.email.eqlEq("[email protected]"))  .all()// Free text: search names containing "dan",// sorted, still encrypted end to endconst matches = await db.orm.Customer  .where(c => c.name.eqlMatch("dan"))  .orderBy((c) => eqlAsc(c.name))  .all()

Results remain encrypted until the application explicitly decrypts them. That creates a clear boundary around plaintext access.

decrypt.ts

import { decryptAll } from "@cipherstash/prisma-next/runtime"// Results stay encrypted until you say otherwiseawait decryptAll(customers)const email = await customers[0].email.decrypt()

§ 03·0x03/SETUP

Four steps to encrypted Prisma data.

Start with a fresh project and experience the full integration end to end.

Scaffold

Create a Prisma 8 app.

Scaffold a fresh project with the Prisma 8 CLI. Try it in a throwaway app first. You can wire up an existing application later.

Database

Create a Prisma Postgres database.

The scaffold connects your app to Prisma Postgres. No proxy to deploy and no database extension to install by hand. Prisma 8 installs the EQL package during migration.

Install

Add the CipherStash extension.

One command signs you in to CipherStash, creates a keyset, and adds the Prisma integration to your application. That is the whole setup.

Encrypt

Encrypt, query, decrypt.

Change a field to a cipherstash type in your data contract, apply the migration, and query it. Prisma 8 installs the encrypted column types and searchable indexes for you.

§ 04·0x04/EXISTING APPS

Already in production? Migrate incrementally.

For an existing Prisma application, CipherStash can be introduced without a risky one-shot migration. Encrypted columns run alongside plaintext until you are ready to cut over.

/01

Initialize CipherStash.

Run npx stash init --prisma in your existing application. No schema changes yet.

/02

Add encrypted columns alongside plaintext.

Add CipherStash encrypted fields next to the plaintext columns you want to protect. Existing reads and writes keep working.

/03

Backfill existing data.

Run stash backfill. CipherStash encrypts the existing values and writes them into the new encrypted columns.

/04

Remove the plaintext columns.

Once the migration is verified, drop the original columns so only encrypted values remain.

§ 05·0x05/ECOSYSTEM

Built for the Prisma stack.

Advanced database capabilities that feel native to Prisma, without giving up the type-safe developer experience.

/CONTRACT

The contract is the source of truth.

Encrypted types live in your data contract. Prisma 8 manages the column types, database extension, and searchable indexes through the same migration lifecycle as the rest of your schema.

/SEARCH

Searchable encryption.

Exact-match lookups, free-text search, range queries, sorting, and queries over encrypted JSON. Standard B-tree and GIN indexes work, so many queries are sub-millisecond even on large datasets.

/KEYS

Every value has its own key.

Each sensitive value is encrypted with its own derived data key. In practice: your application can decrypt, a stolen database credential cannot, a leaked backup cannot, and CipherStash never sees your plaintext or your keys. Tie access to user identity through providers like Clerk and Auth0 and even your application can only decrypt what the signed-in user is authorized to see.

/DECRYPT

Explicit decryption.

Query results stay encrypted until application code decrypts them. Sensitive values cannot leak into a JSON response, a log line, or an AI prompt just because an object was serialized.

/POSTGRES

Works with Prisma Postgres.

The integration works with Prisma Postgres and fits naturally into applications deployed with Prisma Compute.

§ 06·0x06/USE CASES

Sensitive data, still searchable.

Field-level encryption usually means giving up the queries your product depends on. With CipherStash it does not.

/CUSTOMER-RECORDS

Encrypt customer and financial records. Keep the admin panel.

Names, emails, and account details stay encrypted in Postgres. Support can still look up a customer by email, search names by fragment, and sort results. A breach of the database exposes ciphertext, not customers.

/AI-APPS

Give AI agents data access you can prove.

Agents query encrypted data and decrypt only what the signed-in user is authorized to see. Explicit decryption means private data cannot leak into a prompt just because an object was serialized.

§ 07·0x07/DATA LEVEL ACCESS CONTROL

Control follows the data, not the perimeter.

When every value is encrypted independently, every query is encrypted, and every decryption is authorized against the identity making the request, access control moves from the application perimeter to the data itself. Instead of asking who can access the database, you can answer a more important question: who can access this specific piece of data, right now.

SEE HOW THE INFRASTRUCTURE WORKS

§ 08·0x08/GET STARTED

Add searchable encryption to your Prisma app today.

Scaffold a Prisma 8 app and encrypt your first field in minutes. Free tier includes 10K operations/month.

GET STARTED WITH PRISMA READ THE QUICKSTART