---
title: "Encryption"
description: "Transparent data encryption (AES-256-GCM) at rest and TLS in transit for HeliosDB Lite."
---

# Encryption

## At Rest: Transparent Data Encryption

HeliosDB Lite encrypts row values with AES-256-GCM before they are written to the data
directory and decrypts them on read. SQL, drivers and the REST API work unchanged.

```toml
# config.toml
[encryption]
enabled = true
key_source = { Environment = "HELIOSDB_ENCRYPTION_KEY" }   # or { File = "/path/to/key" }
```

```bash
export HELIOSDB_ENCRYPTION_KEY="$(openssl rand -hex 32)"   # 256-bit key, 64 hex characters
export HELIOSDB_JWT_SECRET="$(openssl rand -hex 32)"
heliosdb-lite start --data-dir ./secure --config config.toml
```

```sql
SELECT encryption_enabled, algorithm FROM pg_encryption_status;
```

| Capability | Status |
|------------|--------|
| AES-256-GCM, random 96-bit nonce per value | Available |
| Key from an environment variable or a key file | Available |
| Cloud KMS key sources (AWS, Azure, GCP) | Planned |
| Online key rotation (`ALTER SYSTEM ROTATE ENCRYPTION KEY`) | Planned |
| Zero-knowledge encryption (keys never leave the client) | Planned |

Keep a backup of the key: without it, encrypted data cannot be recovered.

## In Transit: TLS

Start the server with a certificate and key; clients then negotiate TLS on the
PostgreSQL port and should use `sslmode=require` or stricter:

```bash
export HELIOSDB_JWT_SECRET="$(openssl rand -hex 32)"
heliosdb-lite start --data-dir ./secure --tls-cert server.crt --tls-key server.key
```

## Learn More

- [Encryption Quick Start](/docs/lite/guides/encryption_quickstart/)
- [Transparent Data Encryption Tutorial](/docs/lite/guides/tutorials/encryption_tutorial/)
- [PostgreSQL SSL/TLS Configuration](/docs/lite/guides/postgresql_ssl_configuration/)