Skip to content
HeliosDB HeliosDB Lite

Encryption

At Rest: Transparent Data Encryption

HeliosDB Lite encrypts row values with AES-256-GCM before they are written to the data directory and decrypts them on read. SQL, drivers and the REST API work unchanged.

config.toml
[encryption]
enabled = true
key_source = { Environment = "HELIOSDB_ENCRYPTION_KEY" }   # or { File = "/path/to/key" }
Terminal window
export HELIOSDB_ENCRYPTION_KEY="$(openssl rand -hex 32)"   # 256-bit key, 64 hex characters
export HELIOSDB_JWT_SECRET="$(openssl rand -hex 32)"
heliosdb-lite start --data-dir ./secure --config config.toml
SELECT encryption_enabled, algorithm FROM pg_encryption_status;
CapabilityStatus
AES-256-GCM, random 96-bit nonce per valueAvailable
Key from an environment variable or a key fileAvailable
Cloud KMS key sources (AWS, Azure, GCP)Planned
Online key rotation (ALTER SYSTEM ROTATE ENCRYPTION KEY)Planned
Zero-knowledge encryption (keys never leave the client)Planned

Keep a backup of the key: without it, encrypted data cannot be recovered.

In Transit: TLS

Start the server with a certificate and key; clients then negotiate TLS on the PostgreSQL port and should use sslmode=require or stricter:

Terminal window
export HELIOSDB_JWT_SECRET="$(openssl rand -hex 32)"
heliosdb-lite start --data-dir ./secure --tls-cert server.crt --tls-key server.key

Learn More