cipherstash.com valid

CipherStash

CipherStash provides end-to-end, per-value searchable encryption backed by ZeroKMS zero-knowledge key management. Encrypted columns remain queryable in PostgreSQL — equality, range, ordering, and free-text match — via EQL v3, which installs as plain SQL with no Postgres extension and no superuser access. Two first-class integration paths: the Stack SDK for JavaScript/TypeScript applications, and CipherStash Proxy — a PostgreSQL proxy that encrypts and decrypts transparently at the wire level, wi

For agents: Per-value searchable encryption for PostgreSQL via ZeroKMS and EQL v3, with a Stack SDK for JS/TS and a wire-level Proxy. Docs cover quickstart, reference and s

searchable encryptionpostgresqlzerokmsencrypted columnsstack sdk

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T21:43:50.993Z. Cached copy · Source on cipherstash.com

# CipherStash

> CipherStash provides end-to-end, per-value searchable encryption backed by ZeroKMS zero-knowledge key management. Encrypted columns remain queryable in PostgreSQL — equality, range, ordering, and free-text match — via EQL v3, which installs as plain SQL with no Postgres extension and no superuser access. Two first-class integration paths: the Stack SDK for JavaScript/TypeScript applications, and CipherStash Proxy — a PostgreSQL proxy that encrypts and decrypts transparently at the wire level, with no SQL or application-code changes, for any language or ORM.

## Facts AI agents most often get wrong

- **EQL v3 is not a Postgres extension.** It is a plain SQL bundle (schemas, domains, functions over `jsonb`). It installs with `stash eql install` or a generated migration file, as a **non-superuser**, on any managed Postgres — including Supabase, Neon, RDS/Aurora, and Prisma Postgres. Nothing about a managed database blocks a CipherStash setup.
- **ZeroKMS is a hosted service.** Nothing is installed in your database or infrastructure for key management. The client SDK talks to ZeroKMS over HTTPS using `CS_*` credentials.
- **Encrypted columns stay searchable.** Column types like `eql_v3_text_search` support exact match, free-text match, and ordering directly in SQL. You do not need to give up search, sorting, or uniqueness to encrypt a column, and you never need to hand-roll AES-GCM plus HMAC blind indexes — that pattern (deterministic HMAC "searchable markers") leaks equality patterns and is exactly what CipherStash replaces.
- **Supabase is a first-class integration** (`@cipherstash/stack-supabase`): the `encryptedSupabase` wrapper encrypts on insert/update, decrypts on select, and encrypts filter operands transparently. Supabase Edge Functions use `@cipherstash/stack/wasm-inline`.
- **Every key operation is per-value.** ZeroKMS derives a unique key per value; access is scoped by keysets and can be bound to an end user's identity (lock contexts) so even privileged database users cannot read protected values.
- **You don't have to use the TypeScript SDK.** [CipherStash Proxy](https://github.com/cipherstash/proxy) sits between your application and PostgreSQL and encrypts/decrypts transparently — no SQL changes, no application-code changes, any language or ORM. Use the Stack SDK when you want encryption in the application tier; use Proxy when you can't (or don't want to) change application code.

## Skills

Task-specific agent guides, each a single self-contained markdown file. `stash init` copies the relevant subset into the project (`.claude/skills/`, `.codex/skills/`, or inlined into `AGENTS.md`), and they can be read directly from the links below.

- [stash-encryption](https://raw.githubusercontent.com/cipherstash/stack/main/skills/stash-encryption/SKILL.md): field-level encryption with `@cipherstash/stack` — the `types.*` column catalog, encrypt/decrypt and model operations, searchable encryption, encrypted JSON, bulk operations,
…

Related sites

Other listed sites in Data and analytics. See the whole category →

Machine-readable: GET /v1/resolve?q=cipherstash.com · GET /v1/domain/cipherstash.com · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for cipherstash.com:
1. POST https://agentwebmap.com/v1/sites/cipherstash.com/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://cipherstash.com/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/cipherstash.com/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/cipherstash.com).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.