Postgres Encryption

Baffle's Data Protection Services simplifies tokenization, encryption and masking of data in Postgres without any application code changes and with virtually no performance overhead.

Customers may struggle when trying to protect sensitive data in a Postgres database. The methods that exist are clunky and require significant developer effort to implement and to maintain that functionality. Further, many customers are migrating off of Oracle databases and encrypting data in cloud Postgres databases. They have a need to implement stronger security in the cloud to protect their sensitive data.

In addition, AWS Aurora also uses a scalable and performant server-less implementation of Postgres. Increasingly, customers are storing more and more data in these cloud database platforms. Data storage encryption is really needed in this scenario, and it's one that more organizations find themselves relying upon.

Without data-centric protection at the field level, attackers can easily access data as evidenced by the continued onslaught of data breaches. Still, implementing such security measures can be time consuming and costly, not to mention difficult to enable for Postgres.

Postgres encryption is achieved through Baffle with no obstruction or interruptions for end-users, and decryption occurs on-the-fly as users require the data.

Customers have consistently cited the low to no performance overhead of Baffle's data encryption solution and the ease with which it integrates and supports cloud native services. With Baffle, to encrypt or not to encrypt at the field level is never a question with SQL.

The Baffle Data Protection Service provides a transparent data-centric security layer that offers several data protection modes. Capabilities include data de-identification, tokenization, field-level encryption, record-level encryption, format preserving encryption (FPE), BYOK for SaaS, dynamic data masking and more.

Unfortunately, data breaches continue to occur, but Baffle reduces the risk of data breaches by encrypting and masking data end-to-end. That means that even if a security breach takes place, the data won't be able to be read or used in any way. With insider threats becoming more abundant, having encrypted data and masked is all the more important.

In a zero trust model, Baffle assumes that security breaches will occur, and that the best solution is to protect the actual data values. Baffle helps prevent data leakage or theft by keeping data encrypted or masked wherever it is stored. By doing so, even if attackers move laterally through your network, the data remains protected.

Enabling data-centric security in Postgres protects data from disclosure due to unsecured networks, careless work habits or database server theft. Encryption also helps companies comply with sensitive data and data privacy regulations for medical records or financial transactions.

Postgres Encryption Demo

Watch this 2-minute-and-30-second video on postgres encryption of an AWS RDS Postgres database.  The video shows an in-place migration to demonstrate transparent data encryption of postgres and how easily Baffle can enable simplified database encryption for stronger data protection. Baffle's solution stands-out amongst encryption options due to its transparency, performance, and ease-of-use.

Baffle supports the following:

  • AWS Aurora Postgres
  • AWS RDS Postgres
  • IBM Cloud Databases for PostgreSQL
  • Microsoft Azure Postgres
  • Google Cloud SQL for PostgreSQL
  • PostgreSQL on Nutanix

Data Protection Services

The Baffle Data Protection Service provides a transparent data-centric security layer that  offers several data protection modes.  Capabilities include data de-identification, tokenization, field level encryption, record level encryption, format preserving encryption (FPE) BYOK for SaaS, dynamic data masking, database encryption solutions such as file encryption, file content encryption, encryption API services, role-based access control (RBAC), privacy preserving analytics and secure data sharing.

download iconDownload the Data Protection Services Data Sheet

usage monitoring icon

Usage Monitoring

Monitor access to databases to identify patterns or anomalous behavior and profile applications

access control icon

Role-Based Access Control

Define which systems, users or groups can access data stores and dynamically entitle who can see what data

Dynamically mask data at the presentation layer to obscure data values from specific users or groups

De-identify and tokenize data using format preserving encryption or deterministic encryption modes

Data-centric protection at the field or record level in data stores secures the actual data values

Provides an off-the-shelf BYOK service for SaaS vendors to support multiple customer-owned keys in multi-tenant environments

Encrypt files and de-identify data in cloud data lakes to enable AI and privacy preserving analytics

Utilizes Secure Multiparty Compute (SMPC) to enable operations on encrypted data such as wildcard and sort in MySQL, Postgres, SQL Server and other databases

Enable secure sharing of data across multiple parties without revealing private values to other participants

Schedule a live demo with one of our solutions experts to get answers to your questions