Searchable field-level encryption on Supabase with CipherStash

Summary

CipherStash’s integration for Supabase adds searchable field-level encryption to Postgres applications without requiring a schema change. The encrypted Supabase SDK wrapper encrypts marked fields in the application, stores each value as a JSON payload containing ciphertext and Searchable Encrypted Metadata (SEM), and converts queries to SEM so Postgres can filter, sort, and join without plaintext access. ZeroKMS keeps keys under the customer’s control, while decryption policies determine who can read each value; the source states that neither CipherStash nor Supabase can access plaintext data. The integration supports Supabase.js, Drizzle, and Prisma Next, with a one-command setup, and CipherStash Proxy covers analytics, background workers, and other direct database access through the Postgres wire protocol.

Takeaways

1. 1

   Each encrypted value has a unique key derived on demand through ZeroKMS, and keys can be split across regions for data residency requirements.

2. 2

   Encrypted fields continue to support WHERE clauses, fuzzy text matching, ORDER BY, joins, and JSON queries through the SDK.

3. 3

   CipherStash Proxy provides direct database access for analytics jobs, admin tools, background workers, and other cases where the SDK is not suitable.