How to Enable Encryption at Rest in ParadeDB

How do I enable encryption at rest in ParadeDB?

Encryption at rest secures ParadeDB’s on-disk data with transparent AES encryption, preventing unauthorized reads of database files or backups.

Welcome to the Galaxy, Guardian!
You'll be receiving a confirmation email

Follow us on twitter :)

Oops! Something went wrong while submitting the form.

Description

Example H2

Example H3

What does “encryption at rest” mean in ParadeDB?

Encryption at rest automatically encrypts every database page written to disk, WAL segment, and base backup. ParadeDB handles the cryptography, so client applications continue to run unchanged.

When should I encrypt ParadeDB data files?

Enable encryption when your Orders, Customers, and Products tables hold sensitive PII, payment info, or business secrets. Compliance frameworks (PCI-DSS, SOC-2, HIPAA) often require it.

How do I turn on encryption at rest?

Provision ParadeDB with the ENV variable PARADED_ENCRYPTION_KEY or set --encryption-key in paradedb start. ParadeDB rewrites existing files into an encrypted tablespace in place.

Step-by-step

1. Generate a 256-bit key: openssl rand -base64 32 > /secure/keyfile.
2. Export it: export PARADEDB_ENCRYPTION_KEY=$(cat /secure/keyfile).
3. Start ParadeDB: paradedb start --data-dir=/var/lib/paradedb.

How do I verify encryption is active?

Run SHOW parade_encryption;. A value of on confirms every page is encrypted. Reading any base/ file with hexdump should show random bytes, not plain text.

Can I create additional encrypted tablespaces?

Yes. Use SELECT parade_create_tablespace('secure_ts','/mnt/secure','aes256'); then ALTER TABLE Orders SET TABLESPACE secure_ts;. ParadeDB re-writes each moved relation encrypted.

What about column-level encryption?

Combine at-rest encryption with pgcrypto or pgsodium for field-level security: UPDATE Customers SET email = crypto_aead_encrypt(email,'','','nonce') WHERE id = 1;.

Does encryption hurt performance?

AES-NI hardware acceleration keeps overhead <5 %. Benchmark your workload; ParadeDB’s buffer cache and parallelism often mask latency.

How do I rotate the key safely?

1. Export new key to PARADED_ENCRYPTION_KEY_NEW.
2. Run SELECT parade_rotate_key();. ParadeDB background-rewrites every file while staying online. Monitor progress via pg_stat_progress_rewrite.

Best practices

• Store keys in an HSM or KMS.
• Automate key rotation every 90 days.
• Encrypt logical backups with gpg even though base backups are already encrypted.

Why How to Enable Encryption at Rest in ParadeDB is important

How to Enable Encryption at Rest in ParadeDB Example Usage


-- Check total revenue while cluster is encrypted
SELECT c.name,
       SUM(oi.quantity * p.price) AS customer_spend
FROM   Orders o
JOIN   Customers c ON c.id = o.customer_id
JOIN   OrderItems oi ON oi.order_id = o.id
JOIN   Products p   ON p.id = oi.product_id
GROUP  BY c.name
ORDER  BY customer_spend DESC;

How to Enable Encryption at Rest in ParadeDB Syntax


-- Enable cluster-wide encryption at startup
PARADEDB_ENCRYPTION_KEY=base64:K7yPD9v/LSyC0G0RXzAnK2T9oE1gMAET5LiYfpQkYXI=
paradedb start --data-dir=/var/lib/paradedb

-- Create an encrypted tablespace
SELECT parade_create_tablespace(
    'secure_ts',                        -- tablespace name
    '/mnt/secure',                      -- encrypted mount point
    'aes256'                            -- algorithm
);

-- Move ecommerce data
ALTER TABLE Orders     SET TABLESPACE secure_ts;
ALTER TABLE OrderItems SET TABLESPACE secure_ts;

-- Verify encryption flag
SHOW parade_encryption;

Common Mistakes

Relying on disk-level encryption only. Full-disk encryption protects powered-off drives but leaves data exposed when ParadeDB is running. Always enable ParadeDB’s native encryption.
Storing the encryption key on the same server. If the host is compromised, attackers steal both data and key. Use external KMS or environment injection during container startup.

Frequently Asked Questions (FAQs)

Can I enable encryption on an existing ParadeDB cluster?

Yes. Export PARADEDB_ENCRYPTION_KEY then run SELECT parade_encrypt_cluster();. The function rewrites data in place while the database remains online.