---
title: "Searchable field-level encryption on Supabase with CipherStash"
description: "CipherStash’s integration for Supabase adds searchable field-level encryption to Postgres applications without requiring a schema change. The encrypted Supabase SDK wrapper encrypts marked fields in the application, stores each value as a JSON payload containing ciphertext and Searchable Encrypted Metadata (SEM), and converts queries to SEM so Postgres can filter, sort, and join without plaintext access. ZeroKMS keeps keys under the customer’s control, while decryption policies determine who can read each value; the source states that neither CipherStash nor Supabase can access plaintext data. The integration supports Supabase.js, Drizzle, and Prisma Next, with a one-command setup, and CipherStash Proxy covers analytics, background workers, and other direct database access through the Postgres wire protocol."
---

# Searchable field-level encryption on Supabase with CipherStash

[Supabase](https://yomu.fyi/company/supabase) · bilharmer · Jul 9, 2026

**Type:** Announcement

## Summary

CipherStash’s integration for Supabase adds searchable field-level encryption to Postgres applications without requiring a schema change. The encrypted Supabase SDK wrapper encrypts marked fields in the application, stores each value as a JSON payload containing ciphertext and Searchable Encrypted Metadata (SEM), and converts queries to SEM so Postgres can filter, sort, and join without plaintext access. ZeroKMS keeps keys under the customer’s control, while decryption policies determine who can read each value; the source states that neither CipherStash nor Supabase can access plaintext data. The integration supports Supabase.js, Drizzle, and Prisma Next, with a one-command setup, and CipherStash Proxy covers analytics, background workers, and other direct database access through the Postgres wire protocol.

## Context

Traditional field-level encryption makes values opaque to Postgres, preventing ordinary searches, indexes, and joins; applications must otherwise retrieve rows, decrypt them, and filter in memory. The source presents the integration as an option for teams handling regulated data while retaining database search capabilities.

## Approach / What changed

The encrypted Supabase SDK wrapper encrypts selected fields before they reach the database and stores ciphertext with Searchable Encrypted Metadata in a JSON payload. Queries are converted to SEM, while decryption policies are enforced when authorized ciphertexts are decrypted. ZeroKMS manages keys, and CipherStash Proxy supports tools and clients using the Postgres wire protocol.

## Takeaways

- Each encrypted value has a unique key derived on demand through ZeroKMS, and keys can be split across regions for data residency requirements.
- Encrypted fields continue to support WHERE clauses, fuzzy text matching, ORDER BY, joins, and JSON queries through the SDK.
- CipherStash Proxy provides direct database access for analytics jobs, admin tools, background workers, and other cases where the SDK is not suitable.

**Tags:** [Postgres](https://yomu.fyi/topic/postgres), [Privacy](https://yomu.fyi/topic/privacy), [Search](https://yomu.fyi/topic/search), [TypeScript](https://yomu.fyi/topic/typescript)

- Source: [Supabase](https://supabase.com/blog/searchable-field-level-encryption-with-cipherstash)
- Source URL: https://supabase.com/blog/searchable-field-level-encryption-with-cipherstash
- Ingested by Yomu: 2026-08-30T08:01:00.489Z

[Read original post](https://supabase.com/blog/searchable-field-level-encryption-with-cipherstash)