onkara
How does one implement column level encryption using Ecto/Phoenix with Postgresql? I understand pgcrypto extension has functions to support encryption/decryption, my questions are
- How can I invoke those using Ecto syntax for a particular column?
- How and where to supply the decryption key? This is most important. I am assuming decryption key will need to be supplied on the db connection made over TLS
Would like to hear your thoughts on this. Thanks in advance.
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Error tracking, logs, APM, uptime and cron monitoring in one dev-friendly platform. Find and fix problems before your users notice.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixirconf-us
- #elixir-ls
- #ai
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 6 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
onkara
In a multiple tenant situation can Cloak be configured at runtime to use a different key unique to that tenant?
hauleth
Ok, fair.
In that case encrypt data in application and transfer it encrypted over the wire. However remember that it will use the same key for all entries, so it will protect you only in case if the DB itself is breached (without breaching application). If application is breached, then there is nothing that will prevent reading that data.
onkara
For healthcare focused companies seeking HIPAA/HITRUST certification, big clients (hospitals etc) demand column level encryption as a last defense against any breach to protect Protected Health Information (PHI) or Personally Identifiable Information (PII) like patient condition and other identifiers.
hauleth
You don’t. Well, you can, but you shouldn’t use
pgcrypto, it is (almost) never good idea.In 99% of the cases it isn’t something you want. Describe your usecase exactly to check if you need such solution at all.
onkara
Thanks @opsb that’s very helpful
For a multi-tenant setting though it seems cloak_ecto won’t work as only one key can be defined
opsb
We’ve been using Cloak.Ecto — cloak_ecto v1.3.0 for this purpose. Has been working well for a couple of years now.