alt Hacker News> Anywhere you need direct database access outside your application, CipherStash Proxy provides a secure escape hatch.
This sounds like a back door. Is it?
To me, the whole article feels super-unclear about what exactly is involved.
Can HN folks who know more weigh in?
Hey, CipherStash founder here.
Our model is that data is encrypted in the application before being saved to the database. In order to encrypt, decrypt or query, you need to use the SDK (@cipherstash/stack). Connecting via psql, pgadmin etc, you'll only ever be able to see encrypted values (those tools don't know how to decrypt).
Proxy connects to the database and then you connect to the proxy (with psql or whatever). Proxy can now perform queries and decryptions on your behalf so that you can still access data if you need - hence "escape hatch".
The proxy authenticates using your credentials (or an access key) and interacts with the key management server.
Hope that helps!