Cipherstash
Data Level Access Control in TS/JS
Last verified:
What is Cipherstash?
CipherStash Stack is a set of composable building blocks for adding Data Level Access Control (DLAC) to TypeScript applications. DLAC enforces access on individual data values where each value carries its own encryption and the right to decrypt is bound to an identity. Unlike encryption at rest that protects disk or row-level security that gates which rows a user sees, DLAC protects the data itself and that protection travels with the value wherever it goes.
The stack consists of five pieces: Encryption (value-level searchable encryption for any field with Postgres filters running directly over ciphertext via EQL), Key management (ZeroKMS - a hyper-fast key service backed by AWS KMS with a unique data key per value, up to 14x faster than AWS KMS direct), Proxy (CipherStash Proxy sits between app and Postgres applying encryption transparently with zero code changes), Auth (OIDC integration so an end-user's identity authorizes decryption, not a service account), and Skills (agent skills for encryption and data security documented for AI agents in editors).
CipherStash Stack is for teams building TypeScript apps with Postgres who need to protect sensitive data like email addresses, phone numbers, or free-text notes. It serves highly regulated industries including healthcare (Journalia for medical transcription), energy (Amber Electric for GDPR compliance), and financial crime compliance (BNDRY). The tool supports Prisma Next, Drizzle ORM, Supabase, and DynamoDB integrations, making it suitable for teams wanting to encrypt one field at a time without big-bang migrations.
Cipherstash pricing
Pricing model: Freemium
The website does not explicitly state pricing details. CipherStash Stack is open source. The documentation mentions getting started with device-based authentication and no environment variables for local development. Teams can start encrypting fields in under 15 minutes using the free CLI tool. For production deployment, environment variables are used for CI/CD and hosting. The service has over 1B+ values encrypted in production across regulated industries.
Cipherstash pros
- Value-level searchable encryption for any field
- Unique encryption key per single record (field-level encryption)
- Postgres filters, sorts, and joins run directly over ciphertext via EQL
- Data stays encrypted at rest, in transit, and in use
- ZeroKMS up to 14x faster than AWS KMS direct for bulk operations
- No key caching gymnastics required for application
- Identity-bound decryption tied to real end-user identity
- Cryptographic audit trail of every data access event
- CipherStash Proxy works with zero application code changes
- Supports equality, free text search, range queries, ORDER BY, and JSON operations
- Sub-millisecond overhead (454μs median for exact-match query)
- Works with existing Postgres stack without re-platforming
- Integrates with Prisma Next, Drizzle ORM, Supabase, and DynamoDB
- Treats agents as first-class identities with their own keys and policy
- npx stash init completes encryption setup in under 15 minutes
- Device-based authentication with no environment variables for local dev
- Open source with 1B+ values already encrypted in production
- Per-value keys enable precise cryptographic audit trail
- OIDC integration with caching and claims mapping
- Can be adopted one field at a time without big-bang migrations
Cipherstash cons
- Primarily designed for TypeScript/JavaScript applications
- Proxy required for non-TypeScript applications
- Secrets feature still coming soon not yet available
- Requires Postgres database (DynamoDB supported but limited)
- Encrypted data stored using jsonb data type requiring schema changes
- Best developer experience with SDK may require code modifications
- Bulk operations faster but still adds some latency versus unencrypted
- Learning curve for EQL (Encrypted Query Language) format
- Agent skills require proper documentation setup for AI agents
- Not all database types supported yet (more integrations coming)
- Migration plan needed for production instance modifications
- OIDC provider setup required for identity integration
- May be overkill for applications without sensitive data needs
- Requires AWS KMS backing for ZeroKMS functionality
- CLI setup requires login/signup and keyset creation
Frequently asked questions about Cipherstash
What is CipherStash Stack?
CipherStash Stack is a set of composable building blocks for adding Data Level Access Control (DLAC) to TypeScript apps. It includes encryption in use, key management, a transparent SQL proxy, identity-bound auth, and agent skills. DLAC enforces access on individual data values where each carries its own encryption and the right to decrypt is bound to an identity.
How does searchable encryption work in CipherStash?
Searchable encryption allows Postgres filters, sorts, and joins to run directly over ciphertext via EQL (Encrypted Query Language). Supported operations include simple equality lookups, ILIKE-style free-text search, range queries, ORDER BY, and operations on JSON objects. The median for an encrypted exact-match query is 454μs and 1.46ms for encrypted range queries.
What is ZeroKMS?
ZeroKMS is CipherStash's hyper-fast key management service backed by AWS KMS. It provides a unique data key per value with no caching gymnastics required. ZeroKMS is up to 14x faster than calling AWS KMS directly for bulk encrypt/decrypt operations. Per-value keys enable identity-bound decryption and precise cryptographic audit trails.
What is CipherStash Proxy?
CipherStash Proxy sits between your application and Postgres and applies encryption transparently. It rewrites SQL statements, encrypts parameters, executes against Postgres, and decrypts results on the way back. You can drop it in front of a legacy app with zero code changes, use it for debugging, or run it permanently in production. It works with any language via PostgreSQL wire protocol.
How does identity-bound authentication work?
Stack authorizes every decryption against a real end-user identity from your own identity provider via OIDC integration, never a shared service account or long-lived key. You add your existing IDP as an OIDC provider in workspace settings, then the CipherStash Token Service verifies tokens, caches them, and maps claims on every encrypt and decrypt. Agents also get their own distinct identity.
What databases and ORMs does CipherStash support?
CipherStash Stack primarily targets Postgres with full support for Prisma Next (encrypted fields declared in data contract), Drizzle ORM (encrypted column types and query operators), and Supabase (wrapped with encryptedSupabase keeping .eq(), .like(), .order() working). DynamoDB is also supported for encrypted attributes with searchable equality lookups, with more integrations coming.
How do I get started with CipherStash Stack?
Use the stash CLI with npx stash init which walks you through choosing a database connection, generating an encryption schema, and installing the EQL extension into Postgres. From fresh checkout to first encrypted field takes under 15 minutes. The CLI supports device-based authentication with no environment variables for local dev. Most teams start with the SDK for the best developer experience.
How does CipherStash handle AI agents?
Stack treats agents as first-class identities with their own keys and policy distinct from the user they act for. Enforcement happens in the encryption layer so agents only see decrypted bytes for fields they are explicitly authorized to read, scoped to user and task. A prompt-injected agent cannot exfiltrate what it does not hold keys for. Agent skills are documented for Cursor, Copilot, and Claude Code.
What industries are using CipherStash in production?
Three regulated industries using Stack include: Amber Electric (climate-focused energy retailer using TypeScript Lambdas against Postgres and DynamoDB for GDPR compliance), Journalia (AI-driven medical transcription for European healthcare with identity-bound encryption so only the doctor who created a patient note can decrypt it), and BNDRY (financial-crime risk platform running Proxy in Kubernetes to protect customer JSONB data with encrypted search).
How does CipherStash compare to row-level security?
Row-level security gates access by policy but the policy lives in the database's configuration and the database itself still reads plaintext to evaluate it. With CipherStash, ciphertext goes in your existing database and queries keep working. Per-value keys, identity-bound decryption, and cryptographic audit trail are properties of the encryption itself, not the wrapping configuration. A misconfigured rule produces ciphertext rather than leaking plaintext.