Encryption where you hold the key.

Opt-in client-side encryption for your most sensitive fields. The key lives in your infrastructure, not ours, so WattleDB stores only ciphertext and one-way hashes. Our staff, our backups, and any subpoena served on us will see ciphertext where your personal-data fields used to be — your schema, row counts and unencrypted columns remain visible to us. And you can still search it.

See how it will work end-to-end — an interactive preview of the mechanism, running entirely in your browser. It is not a live feature and not a connection to a WattleDB database: encrypt a record, watch only ciphertext cross the wire, then search it without ever decrypting.

Try the interactive preview →

How it works

The provider that can't read your data

Encryption only means "the provider can't read it" if the provider never holds the key. So the crypto happens in your trust domain, and WattleDB only ever receives the output:

[ YOUR TRUST DOMAIN ] [ WATTLEDB ] your app ──▶ encryption layer ───────── ciphertext + ──▶ Postgres │ blind index (stores holds the key only this) (we never see it) search term ──▶ hash to blind index ──── WHERE bidx = … ──▶ matches on hash result ◀── decrypt with key ◀────── ciphertext ◀──── returns ciphertext

Built on Acra, open-source, audited field encryption, with keys you generate and keep. It layers on top of the WattleDB Postgres you already run, on higher plans, opt-in per database.

Straight about it

What it protects, and what it doesn't

✅ Protects the encrypted fields from us

WattleDB staff, a server compromise, a stolen backup and a subpoena served on WattleDB will see only ciphertext and hashes in the fields you encrypt. We won't be able to produce those values, because we won't hold the key.

⚠️ Doesn't hide the shape of your data

Table names, column names, row counts, timestamps and which rows exist stay visible to us, along with every column you leave plaintext. Encryption hides field values, not structure.

✅ Still searchable

Exact-match lookups (by email, by member number, by name) work server-side through blind indexes, so your app's search and login flows keep working.

⚠️ You hold the key, and the responsibility

If you lose the key, the data is unrecoverable, by design. Key custody becomes your most important operational task. We'll document it thoroughly.

⚠️ Not every field, not every query

The first release is equality search only (no LIKE/range), and you choose which fields to encrypt versus leave plaintext for querying. We help you choose.

First release is a self-managed beta for developers and builders. The strongest, formally-audited enterprise guarantee follows, we'll be clear at every step about which stage we're at.

Early access

Want this for your app?

Tell us what you're building. We're onboarding a small group of early customers, migrating apps that hold personal data are the best fit, and your feedback shapes what ships.

Australian-owned hosting and a provider that can't read your PII

Australian-owned, Australian-hosted managed Postgres. Start free today; add client-held encryption when it lands.

Get started →