Field-Level Encryption Guide

<h2 id="field-level-encryption-guide" class="position-relative d-flex align-items-center group"> Field-Level Encryption Guide <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="field-level-encryption-guide" aria-haspopup="dialog" aria-label="Share link: Field-Level Encryption Guide"> Share link </button> </h2><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Geode provides native, application-level field-level encryption (FLE) with transparent encryption/decryption, equality search on encrypted fields, and online key rotation. <blockquote> Known issue (2026-03-30) <code>GAP-0271</code> tracks a remaining parser bug on <code>main</code>: semicolon-delimited role input must be rejected or sanitized to prevent unintended plaintext access to FLE-protected fields. Until that patch ships, treat all role lists as trusted server-side data and reject <code>;</code> in any caller-controlled role parameter. </blockquote> <h3 id="overview" class="position-relative d-flex align-items-center group"> Overview <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="overview" aria-haspopup="dialog" aria-label="Share link: Overview"> Share link </button> </h3> <h4 id="what-is-field-level-encryption" class="position-relative d-flex align-items-center group"> What is Field-Level Encryption? <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="what-is-field-level-encryption" aria-haspopup="dialog" aria-label="Share link: What is Field-Level Encryption?"> Share link </button> </h4>Field-Level Encryption allows you to encrypt specific sensitive fields in your graph database while keeping the rest of the data in plaintext. This provides: <ul> <li>Selective Protection: Encrypt only PII, PHI, or other sensitive data</li> <li>Transparent Access: Authorized users see plaintext automatically</li> <li>Searchable Encryption: Equality queries on encrypted fields via blind indexes</li> <li>Key Rotation: Online re-encryption with zero downtime</li> <li>RBAC Integration: Role-based access to plaintext values</li> </ul> <h4 id="key-features" class="position-relative d-flex align-items-center group"> Key Features <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-features" aria-haspopup="dialog" aria-label="Share link: Key Features"> Share link </button> </h4><ul> <li>✅ AEAD Encryption: AES-256-GCM (hardware-accelerated) or ChaCha20-Poly1305</li> <li>✅ Blind Indexes: Equality search without decryption</li> <li>✅ Hierarchical Keys: Multi-layer key derivation (TRK → SK → FEK → BIK)</li> <li>✅ Online Rotation: Zero-downtime key rotation with background re-encryption</li> <li>✅ RBAC Gates: Fine-grained access control to plaintext</li> <li>✅ Audit Trail: Complete encryption/decryption audit logs</li> </ul> <h3 id="architecture" class="position-relative d-flex align-items-center group"> Architecture <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="architecture" aria-haspopup="dialog" aria-label="Share link: Architecture"> Share link </button> </h3> <h4 id="key-hierarchy" class="position-relative d-flex align-items-center group"> Key Hierarchy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-hierarchy" aria-haspopup="dialog" aria-label="Share link: Key Hierarchy"> Share link </button> </h4>Geode uses a four-level key hierarchy for maximum security and flexibility: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Master Key (Environment/KMS) └─ TRK (Tenant Root Key) └─ SK (Schema Key, per tenant+schema) ├─ FEK (Field Encryption Key, per field+version) └─ BIK (Blind Index Key, for searchable fields) </code></pre></div>Key Derivation: HKDF-SHA256 with context strings ensures cryptographic separation. <h4 id="encryption-algorithms" class="position-relative d-flex align-items-center group"> Encryption Algorithms <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encryption-algorithms" aria-haspopup="dialog" aria-label="Share link: Encryption Algorithms"> Share link </button> </h4><table> <thead> <tr> <th>Algorithm</th> <th>Use Case</th> <th>Performance Notes</th> <th>Platform</th> </tr> </thead> <tbody> <tr> <td>AES-256-GCM</td> <td>Default for AES-NI hardware</td> <td>Hardware-accelerated</td> <td>x86-64, ARM with AES support</td> </tr> <tr> <td>ChaCha20-Poly1305</td> <td>Fallback for non-AES platforms</td> <td>Constant-time</td> <td>All platforms</td> </tr> </tbody> </table> Both algorithms provide authenticated encryption with associated data (AEAD), protecting against tampering and context-swapping attacks. <h4 id="envelope-format" class="position-relative d-flex align-items-center group"> Envelope Format <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="envelope-format" aria-haspopup="dialog" aria-label="Share link: Envelope Format"> Share link </button> </h4>Encrypted fields are stored as binary envelopes: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">[alg:u8][version:u16][nonce:12][tag:16][ciphertext_len:u32][ciphertext] </code></pre></div><ul> <li>Algorithm ID: 1=AES-256-GCM, 2=ChaCha20-Poly1305</li> <li>Key Version: For rotation tracking</li> <li>Nonce: 96-bit unique value</li> <li>Tag: 128-bit authentication tag</li> <li>Ciphertext: Encrypted field value</li> </ul> <h4 id="blind-indexes-for-search" class="position-relative d-flex align-items-center group"> Blind Indexes for Search <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="blind-indexes-for-search" aria-haspopup="dialog" aria-label="Share link: Blind Indexes for Search"> Share link </button> </h4>For searchable encrypted fields, Geode maintains a blind index: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">BI = HMAC-SHA256(BIK, normalize(plaintext)) </code></pre></div>Normalization: ASCII lowercase + whitespace trim This allows equality searches (<code>WHERE email = '[email protected]'</code>) on encrypted fields without decryption. Trade-off: Reveals equality patterns (same plaintext → same BI) and value frequency. <h3 id="getting-started" class="position-relative d-flex align-items-center group"> Getting Started <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="getting-started" aria-haspopup="dialog" aria-label="Share link: Getting Started"> Share link </button> </h3> <h4 id="prerequisites" class="position-relative d-flex align-items-center group"> Prerequisites <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="prerequisites" aria-haspopup="dialog" aria-label="Share link: Prerequisites"> Share link </button> </h4><ul> <li>Geode 0.2.x</li> <li>Understanding of your data classification requirements</li> <li>RBAC/roles configured for your users</li> </ul> <h4 id="quick-start-example" class="position-relative d-flex align-items-center group"> Quick Start Example <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="quick-start-example" aria-haspopup="dialog" aria-label="Share link: Quick Start Example"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- 1. Create node type with encrypted fields CREATE NODE TYPE Customer ( id UUID PRIMARY KEY, name STRING, email STRING @encrypted(alg:"AES-256-GCM") @searchable(index:"blind-hmac-sha256") @classify(tags:["PII"]), ssn STRING @encrypted(alg:"AES-256-GCM") @classify(tags:["PII", "Restricted"]) @visible(to_roles:["compliance_officer"]), credit_score INT ); -- 2. Insert data (encryption happens automatically) CREATE (:Customer { id: '550e8400-e29b-41d4-a716-446655440000', name: 'Alice Johnson', email: 'alice@example.com', ssn: '123-45-6789', credit_score: 720 }); -- 3. Query with automatic decryption (for authorized users) MATCH (c:Customer {email: 'alice@example.com'}) RETURN c.name, c.email, c.ssn; -- Authorized user sees plaintext -- Unauthorized user sees "[REDACTED]" for ssn </code></pre></div> <h3 id="schema-annotations" class="position-relative d-flex align-items-center group"> Schema Annotations <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="schema-annotations" aria-haspopup="dialog" aria-label="Share link: Schema Annotations"> Share link </button> </h3>Geode extends GQL with field-level encryption annotations (non-standard, Geode-specific): <h4 id="encrypted" class="position-relative d-flex align-items-center group"> @encrypted <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="encrypted" aria-haspopup="dialog" aria-label="Share link: @encrypted"> Share link </button> </h4>Enable encryption for a field: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">@encrypted(alg:"AES-256-GCM", key_scope:"field", rotate:"90d") </code></pre></div>Parameters: <ul> <li><code>alg</code>: “AES-256-GCM” (default) or “CHACHA20-POLY1305”</li> <li><code>key_scope</code>: “field” (per-field key) or “schema” (shared schema key)</li> <li><code>rotate</code>: Optional rotation interval hint (e.g., “90d”, “1y”)</li> </ul> <h4 id="searchable" class="position-relative d-flex align-items-center group"> @searchable <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="searchable" aria-haspopup="dialog" aria-label="Share link: @searchable"> Share link </button> </h4>Enable equality search via blind index: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">@searchable(index:"blind-hmac-sha256") </code></pre></div>Parameters: <ul> <li><code>index</code>: “blind-hmac-sha256” (only supported option)</li> </ul> Use case: Email addresses, usernames, account IDs Security note: Reveals equality patterns and frequency distribution. <h4 id="visible" class="position-relative d-flex align-items-center group"> @visible <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="visible" aria-haspopup="dialog" aria-label="Share link: @visible"> Share link </button> </h4>RBAC gate for plaintext access: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">@visible(to_roles:["admin", "compliance_officer"]) </code></pre></div>Parameters: <ul> <li><code>to_roles</code>: List of roles permitted to see plaintext</li> </ul> Users without these roles see <code>"[REDACTED]"</code> or ciphertext. <h4 id="classify" class="position-relative d-flex align-items-center group"> @classify <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="classify" aria-haspopup="dialog" aria-label="Share link: @classify"> Share link </button> </h4>Sensitivity classification tags: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">@classify(tags:["PII", "PHI", "Restricted"]) </code></pre></div>Parameters: <ul> <li><code>tags</code>: Classification labels for audit and compliance</li> </ul> <h3 id="common-use-cases" class="position-relative d-flex align-items-center group"> Common Use Cases <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="common-use-cases" aria-haspopup="dialog" aria-label="Share link: Common Use Cases"> Share link </button> </h3> <h4 id="use-case-1-healthcare---patient-records" class="position-relative d-flex align-items-center group"> Use Case 1: Healthcare - Patient Records <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="use-case-1-healthcare---patient-records" aria-haspopup="dialog" aria-label="Share link: Use Case 1: Healthcare - Patient Records"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE NODE TYPE Patient ( patient_id UUID PRIMARY KEY, name STRING, date_of_birth DATE @encrypted(alg:"AES-256-GCM") @classify(tags:["PHI", "Sensitive"]), ssn STRING @encrypted(alg:"AES-256-GCM") @classify(tags:["PHI", "Restricted"]) @visible(to_roles:["physician", "compliance"]), medical_record_number STRING @encrypted(alg:"AES-256-GCM") @searchable(index:"blind-hmac-sha256") @classify(tags:["PHI"]), diagnosis STRING @encrypted(alg:"AES-256-GCM") @classify(tags:["PHI"]) @visible(to_roles:["physician", "nurse"]) ); </code></pre></div>Access control: <ul> <li>Physicians: See all PHI fields</li> <li>Nurses: See diagnosis, not SSN</li> <li>Billing staff: Search by MRN, see redacted diagnosis</li> </ul> <h4 id="use-case-2-finance---customer-data" class="position-relative d-flex align-items-center group"> Use Case 2: Finance - Customer Data <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="use-case-2-finance---customer-data" aria-haspopup="dialog" aria-label="Share link: Use Case 2: Finance - Customer Data"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE NODE TYPE Account ( account_id UUID PRIMARY KEY, customer_name STRING, account_number STRING @encrypted(alg:"AES-256-GCM") @searchable(index:"blind-hmac-sha256") @classify(tags:["PII", "PCI"]), routing_number STRING @encrypted(alg:"AES-256-GCM") @classify(tags:["PCI"]), balance DECIMAL, credit_card_number STRING @encrypted(alg:"AES-256-GCM") @classify(tags:["PCI-DSS", "Restricted"]) @visible(to_roles:["fraud_analyst", "compliance"]) ); </code></pre></div> <h4 id="use-case-3-e-commerce---user-profiles" class="position-relative d-flex align-items-center group"> Use Case 3: E-commerce - User Profiles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="use-case-3-e-commerce---user-profiles" aria-haspopup="dialog" aria-label="Share link: Use Case 3: E-commerce - User Profiles"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE NODE TYPE User ( user_id UUID PRIMARY KEY, username STRING @searchable(index:"blind-hmac-sha256"), email STRING @encrypted(alg:"AES-256-GCM") @searchable(index:"blind-hmac-sha256") @classify(tags:["PII"]), phone STRING @encrypted(alg:"AES-256-GCM") @classify(tags:["PII"]) @visible(to_roles:["customer_service", "admin"]), shipping_address STRING @encrypted(alg:"AES-256-GCM") @classify(tags:["PII"]), preferences OBJECT -- Not encrypted ); </code></pre></div> <h3 id="query-operations" class="position-relative d-flex align-items-center group"> Query Operations <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="query-operations" aria-haspopup="dialog" aria-label="Share link: Query Operations"> Share link </button> </h3> <h4 id="inserting-data" class="position-relative d-flex align-items-center group"> Inserting Data <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="inserting-data" aria-haspopup="dialog" aria-label="Share link: Inserting Data"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Encryption happens automatically CREATE (:Customer { id: gen_uuid(), name: 'Bob Smith', email: 'bob@example.com', ssn: '987-65-4321' }); </code></pre></div>What happens: <ol> <li>Geode detects <code>@encrypted</code> annotation on <code>email</code> and <code>ssn</code></li> <li>Generates unique nonce</li> <li>Encrypts values with appropriate FEK</li> <li>Computes blind index for <code>email</code> (if <code>@searchable</code>)</li> <li>Stores encrypted envelope</li> </ol> <h4 id="querying-encrypted-fields" class="position-relative d-flex align-items-center group"> Querying Encrypted Fields <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="querying-encrypted-fields" aria-haspopup="dialog" aria-label="Share link: Querying Encrypted Fields"> Share link </button> </h4>Equality search (requires <code>@searchable</code>): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">MATCH (c:Customer {email: 'alice@example.com'}) RETURN c.name, c.email; </code></pre></div>What happens: <ol> <li>Geode computes blind index: <code>BI = HMAC(BIK, '[email protected]')</code></li> <li>Looks up records with matching BI</li> <li>For authorized users, decrypts <code>email</code> field</li> <li>Returns plaintext to authorized users, <code>"[REDACTED]"</code> to others</li> </ol> Non-searchable fields: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- ERROR: Cannot filter on non-searchable encrypted field MATCH (c:Customer) WHERE c.ssn = '123-45-6789' RETURN c.name; </code></pre></div> <h4 id="explicit-projection-control" class="position-relative d-flex align-items-center group"> Explicit Projection Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="explicit-projection-control" aria-haspopup="dialog" aria-label="Share link: Explicit Projection Control"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Force plaintext (requires READ_PLAINTEXT privilege) RETURN PLAINTEXT(c.ssn); -- Force ciphertext (always allowed if node readable) RETURN CIPHERTEXT(c.ssn); </code></pre></div> <h3 id="access-control" class="position-relative d-flex align-items-center group"> Access Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="access-control" aria-haspopup="dialog" aria-label="Share link: Access Control"> Share link </button> </h3> <h4 id="granting-plaintext-access" class="position-relative d-flex align-items-center group"> Granting Plaintext Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="granting-plaintext-access" aria-haspopup="dialog" aria-label="Share link: Granting Plaintext Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Grant role access to plaintext GRANT READ_PLAINTEXT ON Customer.ssn TO ROLE compliance_officer; # Revoke access REVOKE READ_PLAINTEXT ON Customer.ssn FROM ROLE analyst; </code></pre></div> <h4 id="permissions-model" class="position-relative d-flex align-items-center group"> Permissions Model <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permissions-model" aria-haspopup="dialog" aria-label="Share link: Permissions Model"> Share link </button> </h4><table> <thead> <tr> <th>Permission</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><code>READ_PLAINTEXT(schema.field)</code></td> <td>View decrypted value</td> </tr> <tr> <td><code>READ_CIPHERTEXT(schema.field)</code></td> <td>View ciphertext (always granted if node readable)</td> </tr> <tr> <td><code>WRITE(schema.field)</code></td> <td>Set value (automatically encrypted)</td> </tr> </tbody> </table> <h4 id="example-access-matrix" class="position-relative d-flex align-items-center group"> Example Access Matrix <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="example-access-matrix" aria-haspopup="dialog" aria-label="Share link: Example Access Matrix"> Share link </button> </h4><table> <thead> <tr> <th>Role</th> <th><code>Customer.name</code></th> <th><code>Customer.email</code></th> <th><code>Customer.ssn</code></th> </tr> </thead> <tbody> <tr> <td><code>customer_service</code></td> <td>Plaintext</td> <td>Plaintext</td> <td><code>[REDACTED]</code></td> </tr> <tr> <td><code>compliance_officer</code></td> <td>Plaintext</td> <td>Plaintext</td> <td>Plaintext</td> </tr> <tr> <td><code>analyst</code></td> <td>Plaintext</td> <td><code>[REDACTED]</code></td> <td><code>[REDACTED]</code></td> </tr> </tbody> </table> <h3 id="key-rotation" class="position-relative d-flex align-items-center group"> Key Rotation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-rotation" aria-haspopup="dialog" aria-label="Share link: Key Rotation"> Share link </button> </h3> <h4 id="why-rotate-keys" class="position-relative d-flex align-items-center group"> Why Rotate Keys? <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="why-rotate-keys" aria-haspopup="dialog" aria-label="Share link: Why Rotate Keys?"> Share link </button> </h4><ul> <li>Compliance: Regulatory requirements (PCI-DSS, HIPAA)</li> <li>Security: Limit blast radius of key compromise</li> <li>Best Practice: Regular rotation reduces cryptographic exposure</li> </ul> <h4 id="online-rotation-process" class="position-relative d-flex align-items-center group"> Online Rotation Process <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="online-rotation-process" aria-haspopup="dialog" aria-label="Share link: Online Rotation Process"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Rotate field encryption key (FEK) geode key rotate --tenant default --schema Customer --field ssn --scope FEK # Check rotation status geode show rotation-status --tenant default # Background re-encryption progress # Records migrated: 12,450 / 50,000 (24.9%) # Estimated completion: 2h 15m </code></pre></div>How it works: <ol> <li>Create new key version (vN+1)</li> <li>New writes use vN+1 immediately</li> <li>Background migration re-encrypts existing records</li> <li>Mixed-version reads supported during migration</li> <li>Opportunistic re-encryption on reads</li> </ol> <h4 id="rotation-scopes" class="position-relative d-flex align-items-center group"> Rotation Scopes <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rotation-scopes" aria-haspopup="dialog" aria-label="Share link: Rotation Scopes"> Share link </button> </h4><table> <thead> <tr> <th>Scope</th> <th>Impact</th> <th>Downtime</th> <th>Use Case</th> </tr> </thead> <tbody> <tr> <td>FEK</td> <td>Re-encrypts field data</td> <td>None</td> <td>Regular rotation (90d-1y)</td> </tr> <tr> <td>SK</td> <td>Rewraps FEKs (no data change)</td> <td>None</td> <td>Schema key compromise</td> </tr> <tr> <td>TRK</td> <td>Rewraps all keys</td> <td>None</td> <td>Tenant key compromise</td> </tr> </tbody> </table> <h4 id="rotation-best-practices" class="position-relative d-flex align-items-center group"> Rotation Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rotation-best-practices" aria-haspopup="dialog" aria-label="Share link: Rotation Best Practices"> Share link </button> </h4><ol> <li>Schedule regular rotations: 90 days for PII, 365 days for less sensitive</li> <li>Monitor progress: Check migration status regularly</li> <li>Plan for load: Background re-encryption consumes I/O</li> <li>Test in staging: Verify rotation process before production</li> <li>Audit rotation: Log all key rotation events</li> </ol> <h3 id="migrating-existing-data" class="position-relative d-flex align-items-center group"> Migrating Existing Data <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="migrating-existing-data" aria-haspopup="dialog" aria-label="Share link: Migrating Existing Data"> Share link </button> </h3> <h4 id="scenario-adding-encryption-to-existing-schema" class="position-relative d-flex align-items-center group"> Scenario: Adding Encryption to Existing Schema <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="scenario-adding-encryption-to-existing-schema" aria-haspopup="dialog" aria-label="Share link: Scenario: Adding Encryption to Existing Schema"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- 1. Alter schema to add encryption ALTER NODE TYPE Customer ALTER PROPERTY ssn SET @encrypted(alg:"AES-256-GCM") SET @classify(tags:["PII", "Restricted"]) SET @visible(to_roles:["compliance_officer"]); -- 2. New writes are encrypted immediately -- 3. Existing plaintext data remains until migration </code></pre></div> <h4 id="running-migration" class="position-relative d-flex align-items-center group"> Running Migration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="running-migration" aria-haspopup="dialog" aria-label="Share link: Running Migration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Encrypt existing plaintext data geode migrate encrypt \ --tenant default \ --field Customer.ssn \ --batch 1000 \ --progress # Output: # Encrypting Customer.ssn... # Batch 1: 1000/50000 (2.0%) - 1.2s # Batch 2: 2000/50000 (4.0%) - 1.1s # ... # Complete: 50000/50000 (100%) - 62.5s </code></pre></div>Migration features: <ul> <li>Resumable: Can restart after failure</li> <li>Batched: Processes records in configurable batches</li> <li>Progress tracking: Real-time migration status</li> <li>Zero downtime: Reads continue during migration</li> </ul> <h4 id="access-during-migration" class="position-relative d-flex align-items-center group"> Access During Migration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="access-during-migration" aria-haspopup="dialog" aria-label="Share link: Access During Migration"> Share link </button> </h4><table> <thead> <tr> <th>User Role</th> <th>Before Migration</th> <th>During Migration</th> <th>After Migration</th> </tr> </thead> <tbody> <tr> <td>Authorized</td> <td>Plaintext</td> <td>Plaintext (auto-decrypt)</td> <td>Plaintext</td> </tr> <tr> <td>Unauthorized</td> <td>Plaintext</td> <td><code>[REDACTED]</code></td> <td><code>[REDACTED]</code></td> </tr> </tbody> </table> <h3 id="performance" class="position-relative d-flex align-items-center group"> Performance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance" aria-haspopup="dialog" aria-label="Share link: Performance"> Share link </button> </h3> <h4 id="benchmarks" class="position-relative d-flex align-items-center group"> Benchmarks <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="benchmarks" aria-haspopup="dialog" aria-label="Share link: Benchmarks"> Share link </button> </h4><table> <thead> <tr> <th>Operation</th> <th>Expected Behavior</th> </tr> </thead> <tbody> <tr> <td>Encrypt field (AES-256-GCM)</td> <td>Microsecond-scale overhead</td> </tr> <tr> <td>Decrypt field (cache hit)</td> <td>Microsecond-scale overhead</td> </tr> <tr> <td>Blind index computation</td> <td>Microsecond-scale overhead</td> </tr> <tr> <td>Key cache lookup</td> <td>Microsecond-scale overhead</td> </tr> </tbody> </table> Hardware: x86-64 with AES-NI, 4-core CPU <h4 id="optimization-tips" class="position-relative d-flex align-items-center group"> Optimization Tips <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="optimization-tips" aria-haspopup="dialog" aria-label="Share link: Optimization Tips"> Share link </button> </h4><ol> <li>Selective encryption: Only encrypt truly sensitive fields</li> <li>Key caching: KeyManager maintains LRU cache (95%+ hit rate)</li> <li>Batch operations: Encrypt/decrypt multiple fields in parallel</li> <li>Hardware acceleration: AES-NI auto-detected and used</li> <li>Searchable sparingly: Blind indexes add 30-50% overhead</li> </ol> <h4 id="monitoring" class="position-relative d-flex align-items-center group"> Monitoring <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="monitoring" aria-haspopup="dialog" aria-label="Share link: Monitoring"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check key cache performance geode stats key-cache # Output: # Key Cache Statistics: # Hits: 125,340 # Misses: 5,612 # Hit Rate: 95.7% # Evictions: 234 </code></pre></div> <h3 id="security-considerations" class="position-relative d-flex align-items-center group"> Security Considerations <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-considerations" aria-haspopup="dialog" aria-label="Share link: Security Considerations"> Share link </button> </h3> <h4 id="threat-model" class="position-relative d-flex align-items-center group"> Threat Model <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="threat-model" aria-haspopup="dialog" aria-label="Share link: Threat Model"> Share link </button> </h4>Protected Against: <ul> <li>✅ Data breach (ciphertext without keys)</li> <li>✅ Ciphertext tampering (authenticated encryption)</li> <li>✅ Context-swapping attacks (AAD binding)</li> <li>✅ Unauthorized plaintext access (RBAC gates)</li> <li>✅ Plaintext in logs (never logged)</li> </ul> Not Protected Against: <ul> <li>❌ Master key compromise</li> <li>❌ Frequency analysis (blind indexes)</li> <li>❌ Access pattern leakage</li> <li>❌ Memory attacks (cold boot)</li> </ul> <h4 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h4>Key Management: <ul> <li>Store master keys in KMS (AWS KMS, Vault, Azure Key Vault)</li> <li>Rotate keys regularly (FEK: 90d, TRK: 1y)</li> <li>Separate tenant keys</li> <li>Monitor key access</li> </ul> Access Control: <ul> <li>Principle of least privilege</li> <li>Regular access reviews</li> <li>Audit all READ_PLAINTEXT grants</li> <li>MFA for sensitive role assignment</li> </ul> Operational: <ul> <li>Never log plaintext or keys</li> <li>Secure memory cleanup (<code>secureZero</code>)</li> <li>Monitor encryption/decryption rates</li> <li>Alert on unusual access patterns</li> </ul> <h4 id="compliance-alignment" class="position-relative d-flex align-items-center group"> Compliance Alignment <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-alignment" aria-haspopup="dialog" aria-label="Share link: Compliance Alignment"> Share link </button> </h4><table> <thead> <tr> <th>Standard</th> <th>Requirement</th> <th>Geode Support</th> </tr> </thead> <tbody> <tr> <td>GDPR</td> <td>Encryption at rest</td> <td>✅ FLE with AEAD</td> </tr> <tr> <td>GDPR</td> <td>Right to erasure</td> <td>✅ Key destruction</td> </tr> <tr> <td>HIPAA</td> <td>PHI encryption</td> <td>✅ AES-256-GCM</td> </tr> <tr> <td>HIPAA</td> <td>Access controls</td> <td>✅ RBAC gates</td> </tr> <tr> <td>PCI-DSS</td> <td>Cardholder data encryption</td> <td>✅ Field-level encryption</td> </tr> <tr> <td>PCI-DSS</td> <td>Key rotation</td> <td>✅ Online rotation</td> </tr> <tr> <td>SOC 2</td> <td>Confidentiality controls</td> <td>✅ Encryption + audit</td> </tr> </tbody> </table> <h3 id="troubleshooting" class="position-relative d-flex align-items-center group"> Troubleshooting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting" aria-haspopup="dialog" aria-label="Share link: Troubleshooting"> Share link </button> </h3> <h4 id="issue-permission-denied-on-query" class="position-relative d-flex align-items-center group"> Issue: Permission Denied on Query <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="issue-permission-denied-on-query" aria-haspopup="dialog" aria-label="Share link: Issue: Permission Denied on Query"> Share link </button> </h4>Error: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Error: SearchNotPermitted - Cannot filter on encrypted field 'ssn' </code></pre></div>Causes: <ol> <li>Field not marked <code>@searchable</code></li> <li>User lacks <code>READ_PLAINTEXT</code> privilege</li> </ol> Solutions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Option 1: Make field searchable (if appropriate) ALTER NODE TYPE Customer ALTER PROPERTY ssn SET @searchable(index:"blind-hmac-sha256"); -- Option 2: Grant user access GRANT READ_PLAINTEXT ON Customer.ssn TO ROLE analyst; </code></pre></div> <h4 id="issue-decryption-failures" class="position-relative d-flex align-items-center group"> Issue: Decryption Failures <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="issue-decryption-failures" aria-haspopup="dialog" aria-label="Share link: Issue: Decryption Failures"> Share link </button> </h4>Error: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Error: AuthenticationFailed - AEAD tag verification failed </code></pre></div>Causes: <ol> <li>Corrupted ciphertext</li> <li>Wrong key used</li> <li>AAD mismatch</li> </ol> Solutions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check key version consistency geode verify encryption --tenant default --schema Customer --field ssn # Re-encrypt if needed geode key rotate --tenant default --schema Customer --field ssn --scope FEK --force </code></pre></div> <h4 id="issue-slow-query-performance" class="position-relative d-flex align-items-center group"> Issue: Slow Query Performance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="issue-slow-query-performance" aria-haspopup="dialog" aria-label="Share link: Issue: Slow Query Performance"> Share link </button> </h4>Symptom: Queries on encrypted fields are slow Diagnosis: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check cache hit rate geode stats key-cache # Profile query PROFILE MATCH (c:Customer {email: '[email protected]'}) RETURN c; </code></pre></div>Solutions: <ol> <li>Ensure blind indexes are created</li> <li>Increase key cache size</li> <li>Review access patterns</li> <li>Consider hardware acceleration</li> </ol> <h3 id="advanced-topics" class="position-relative d-flex align-items-center group"> Advanced Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="advanced-topics" aria-haspopup="dialog" aria-label="Share link: Advanced Topics"> Share link </button> </h3> <h4 id="custom-key-providers" class="position-relative d-flex align-items-center group"> Custom Key Providers <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="custom-key-providers" aria-haspopup="dialog" aria-label="Share link: Custom Key Providers"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">// Implement custom KMS integration const CustomKMSProvider = struct { pub fn deriveKey(context: []const u8) ![]u8 { // Call external KMS } }; </code></pre></div> <h4 id="streaming-large-fields" class="position-relative d-flex align-items-center group"> Streaming Large Fields <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="streaming-large-fields" aria-haspopup="dialog" aria-label="Share link: Streaming Large Fields"> Share link </button> </h4>For fields >64KB: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">// Use streaming encryption const encrypted_stream = try aead.encryptStream(plaintext_reader, fek); </code></pre></div> <h4 id="post-quantum-cryptography" class="position-relative d-flex align-items-center group"> Post-Quantum Cryptography <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="post-quantum-cryptography" aria-haspopup="dialog" aria-label="Share link: Post-Quantum Cryptography"> Share link </button> </h4>Future support for PQC: <ul> <li>Kyber for key wrapping</li> <li>Dilithium for signatures</li> <li>CRYSTALS suite integration</li> </ul> <h3 id="next-steps" class="position-relative d-flex align-items-center group"> Next Steps <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="next-steps" aria-haspopup="dialog" aria-label="Share link: Next Steps"> Share link </button> </h3><ul> <li><a href="/docs/security/kms-integration/" >KMS Integration</a> - External key management</li> <li><a href="/docs/security/overview/" >Security Overview</a> - Complete security architecture</li> <li><a href="/docs/security/authorization/" >Authorization Guide</a> - Role-based access control</li> <li><a href="/docs/ops/audit-logging/" >Audit Logging</a> - Encryption audit trail</li> <li><a href="/docs/configuration/server-configuration/" >Server Configuration</a> - Encryption settings</li> </ul> <h3 id="references" class="position-relative d-flex align-items-center group"> References <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="references" aria-haspopup="dialog" aria-label="Share link: References"> Share link </button> </h3><ul> <li><a href="https://csrc.nist.gov/publications/detail/sp/800-38d/final" aria-label="NIST SP 800-38D – opens in new window" target="_blank" rel="noopener noreferrer" >NIST SP 800-38D ↗ </a> - GCM specification</li> <li><a href="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final" aria-label="NIST SP 800-57 – opens in new window" target="_blank" rel="noopener noreferrer" >NIST SP 800-57 ↗ </a> - Key management</li> <li><a href="https://datatracker.ietf.org/doc/html/rfc5869" aria-label="RFC 5869 – opens in new window" target="_blank" rel="noopener noreferrer" >RFC 5869 ↗ </a> - HKDF specification</li> <li><a href="https://www.iso.org/standard/76120.html" aria-label="ISO/IEC 39075:2024 – opens in new window" target="_blank" rel="noopener noreferrer" >ISO/IEC 39075:2024 ↗ </a> - GQL standard</li> </ul> <hr> License: Apache License 2.0 Copyright: 2024-2025 CodePros Last Updated: January 2026