You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/docs/concepts/key-management.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -161,7 +161,7 @@ The design deliberately keeps the durable pieces small and separated:
161
161
| ZeroKMS | Authority keys and access-control state |
162
162
| Nowhere | Plaintext data keys |
163
163
164
-
Your encrypted data stays in your database. ZeroKMS handles key material, not application data. This separation also shapes recovery: restoring ZeroKMS restores the ability to reproduce keys; it does not require CipherStash to restore or move your encrypted database. See [Disaster recovery](/stack/cipherstash/kms/disaster-recovery).
164
+
Your encrypted data stays in your database. ZeroKMS handles key material, not application data. This separation also shapes recovery: restoring ZeroKMS restores the ability to reproduce keys; it does not require CipherStash to restore or move your encrypted database. Multi-region application patterns are covered in [Data residency](/solutions/data-residency#multi-region-with-regional-key-isolation).
Copy file name to clipboardExpand all lines: content/docs/get-started/choose-your-stack.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,7 +33,7 @@ EQL installs into any Postgres you can connect to. It needs no extension, no sup
33
33
| Neon, RDS, Aurora, Cloud SQL | Yes |`stash eql install` detects a non-superuser role and adapts. |
34
34
| Self-hosted Postgres | Yes | Full operator-class support, so the ORE ordering mechanism is available. |
35
35
| Postgres behind PgBouncer | Yes | Transaction pooling is fine. Proxy has its own pooling. |
36
-
| DynamoDB | Yes, without EQL |[DynamoDB integration](/stack/cipherstash/encryption/dynamodb). Encrypted attributes and HMAC key lookups; no EQL, because there's no Postgres. |
36
+
| DynamoDB | Yes, without EQL |[DynamoDB integration](/integrations/aws/dynamodb). Encrypted attributes and HMAC key lookups; no EQL, because there's no Postgres. |
37
37
| MySQL, MongoDB, others | Not yet | The SDK still encrypts values for you, but nothing is queryable server-side. |
Copy file name to clipboardExpand all lines: content/docs/get-started/what-is-cipherstash.mdx
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -62,7 +62,7 @@ flowchart TB
62
62
63
63
You rarely need all of them at once. The Stack SDK plus EQL is the common case. Proxy is the alternative to the SDK, not an addition to it.
64
64
65
-
Note that **EQL is only for Postgres**. The SDK also encrypts values that never touch a database, and non-Postgres stores like [DynamoDB](/stack/cipherstash/encryption/dynamodb), with no EQL involved.
65
+
Note that **EQL is only for Postgres**. The SDK also encrypts values that never touch a database, and non-Postgres stores like [DynamoDB](/integrations/aws/dynamodb), with no EQL involved.
66
66
67
67
## Choosing what each column reveals
68
68
@@ -99,7 +99,7 @@ Encryption in use is usually assumed to be slow. It is, if you do it with fully
99
99
| vs fully homomorphic encryption |[410,000x faster](https://github.com/cipherstash/tfhe-ore-bench) on the per-row primitives a database actually executes. |
100
100
| vs AWS KMS | Up to 14x the throughput, because ZeroKMS derives keys in bulk rather than one call per value. |
101
101
102
-
The FHE comparison is an open benchmark harness you can run yourself. See [CipherStash vs FHE](/stack/reference/comparisons/fhe) for the methodology, and for the workloads where FHE is genuinely the right tool.
102
+
The FHE comparison is an open benchmark harness you can run yourself. See [CipherStash vs FHE](/concepts/compare/fhe) for the methodology, and for the workloads where FHE is genuinely the right tool.
Copy file name to clipboardExpand all lines: content/docs/guides/deployment.mdx
+88-2Lines changed: 88 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,5 @@
1
1
---
2
2
title: Deployment
3
-
navTitle: Overview
4
3
description: "Deploy CipherStash changes safely across environments, with explicit credential, migration, rollout, monitoring, and rollback gates."
5
4
type: guide
6
5
components: [encryption, eql, cli]
@@ -9,7 +8,7 @@ audience: [developer]
9
8
10
9
CipherStash deployments coordinate application code, database schema, and credentials. Treat each independently deployable stage as a release with its own verification and rollback gate.
11
10
12
-
For the detailed dual-write, backfill, and cutover procedure for populated columns, follow [Encrypt existing data](/guides/migration/encrypt-existing-data). This page covers the production rollout around that migration.
11
+
For the detailed dual-write, backfill, and cutover procedure for populated columns, follow [Data migration](/guides/migration). This page covers the production rollout around that migration.
13
12
14
13
## Before the first deployment
15
14
@@ -96,3 +95,90 @@ Test the correctness of returned values, not only request success rates. An inco
96
95
Prefer application rollbacks while both plaintext and encrypted columns are being maintained. Before plaintext removal, a read cutover can be reversed without changing data: point reads back to the original columns and leave dual-writes running.
97
96
98
97
After plaintext is dropped, rollback becomes a data-recovery operation. Avoid reaching that stage until operational evidence shows the encrypted path is stable and every supported application version has moved forward.
98
+
99
+
## Serverless and bundled applications
100
+
101
+
`@cipherstash/stack` must remain a runtime dependency when a build tool creates
102
+
a server bundle. Configure the bundler to leave the package external, then make
103
+
sure the deployment artifact installs it for the target platform.
104
+
105
+
For Next.js, use `serverExternalPackages`:
106
+
107
+
```typescript filename="next.config.ts"
108
+
const nextConfig = {
109
+
serverExternalPackages: ["@cipherstash/stack"],
110
+
}
111
+
112
+
exportdefaultnextConfig
113
+
```
114
+
115
+
For esbuild, pass `--external:@cipherstash/stack`; for webpack, declare it as a
116
+
CommonJS external. An SST function needs both the esbuild exclusion and a
117
+
runtime install:
118
+
119
+
```typescript filename="sst.config.ts"
120
+
{
121
+
nodejs: {
122
+
esbuild: { external: ["@cipherstash/stack"] },
123
+
install: ["@cipherstash/stack"],
124
+
},
125
+
}
126
+
```
127
+
128
+
Build and start the artifact in a Linux container before release when local
129
+
development uses macOS or Windows. This catches a lockfile or deployment bundle
130
+
that omitted the target platform's runtime package.
131
+
132
+
## Testing and CI
133
+
134
+
Use a separate workspace and database for integration tests. Supply the test
135
+
workspace's four `CS_*` credentials only to the CI job, install the same EQL
136
+
release used by production, and test:
137
+
138
+
- encryption followed by decryption returns the original typed value;
139
+
- every required equality, range, ordering, token, or JSON query returns the
140
+
expected records;
141
+
- a client without the required keyset grant cannot decrypt the data;
142
+
- schema migrations and application code work in both rolling-deployment
143
+
orders.
144
+
145
+
Mocks are useful for business logic that merely passes encrypted values
146
+
through, but they do not test ciphertext compatibility, key access, query
147
+
terms, or EQL behavior. Keep at least one real end-to-end test for every
148
+
encrypted query capability used in production.
149
+
150
+
## Team onboarding
151
+
152
+
Invite each developer to the organization and workspace, then have them run:
153
+
154
+
```bash
155
+
npx stash init
156
+
```
157
+
158
+
Each device receives its own developer identity and client key. Do not share
159
+
production credentials with developers or copy one developer's local profile
160
+
into CI. Remove a departing developer from the workspace and revoke their
161
+
device client keys without changing application credentials.
162
+
163
+
See [workspace members](/reference/workspace/members) and
164
+
[client keys](/reference/auth/clients) for the complete access model.
165
+
166
+
## Deploying Proxy
167
+
168
+
Run CipherStash Proxy as a container in the same private network as PostgreSQL.
169
+
Supply database credentials and CipherStash application credentials from the
170
+
platform's secret manager, expose the PostgreSQL listener only to application
171
+
clients, and expose health or metrics endpoints only to the monitoring plane.
172
+
173
+
For ECS, Kubernetes, or another orchestrator, keep these concerns separate:
174
+
175
+
1. Pull the published Proxy image from the approved registry.
176
+
2. Grant the task or pod permission to read only its deployment secrets.
177
+
3. Configure security groups or network policies for application → Proxy and
178
+
Proxy → database traffic.
179
+
4. Roll out at least two instances where connection availability requires it.
180
+
5. Verify a plaintext write, encrypted database value, encrypted query, and
181
+
decrypted read through the deployed endpoint.
182
+
183
+
Use the [Proxy configuration reference](/reference/proxy/configuration) for
184
+
environment variables, TOML settings, ports, logging, and metrics.
description: "Task-oriented guides: development workflow, data migration, deployment, and troubleshooting."
3
+
description: "Deployment and data migration guidance for CipherStash."
5
4
type: guide
6
5
---
7
6
8
-
This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
9
-
10
-
Until it lands, current documentation lives in the [existing docs](/stack).
7
+
{/*
8
+
Fumadocs requires an index document when generating a metadata-backed folder.
9
+
meta.json excludes this file from the page tree, and Next redirects its route
0 commit comments