Documentation

Emet Docs

How Emet protects sensitive database fields through an inline PostgreSQL-wire proxy, selective AES-256-GCM encryption, controlled key access, and transparent deployment.

Architecture Mechanism Supported Databases Deployment

Architecture

An Inline Proxy, Not a Platform Migration

Emet sits as an inline PostgreSQL-wire proxy between your application and your database. It preserves normal database interactions while encrypting protected values before write commit and decrypting authorized reads. Your schemas, ORMs, and application code do not need to be rewritten.

Application Tier

Your application connects to Emet exactly as it would connect to the database—same drivers, same connection strings, same queries.

Emet Wire Proxy

The proxy interprets PostgreSQL wire traffic and applies selective AES-256-GCM encryption to protected fields before database writes commit.

Storage Tier

The database stores authenticated ciphertext for protected columns rather than plaintext PII. Authorized reads are decrypted by Emet before returning to the application.

Mechanism

The Four Mechanics of Emet

Authenticated Encryption

Protected values are encrypted with AES-256-GCM before write commit, producing ciphertext with integrity protection instead of plaintext at rest.

Wire-Protocol Interception

Encryption and authorized decryption happen inline at the proxy. Reads and writes to protected columns remain compatible with normal application database access.

Controlled Key Access

Key access follows configured approval policies so database access alone is not sufficient to expose protected plaintext.

Selective Column-Level Encryption

You choose exactly which columns to protect—PII, credentials, financial fields—while the rest of the database runs at full native speed.

Compatibility

Supported Databases

Emet natively supports PostgreSQL and PostgreSQL-wire compatible engines. MySQL and Microsoft SQL Server adapters are upcoming.

PostgreSQL

PostgreSQL-Wire Compatible Engines

MySQL Adapter — Upcoming

Microsoft SQL Server Adapter — Upcoming

Deployment

No Rip-and-Replace. No Schema Changes.

Deployment is a connection-string change, not a platform migration. Point your application at the Emet proxy, declare the columns to protect, and new protected values are stored as ciphertext at rest.

1. Connect

Route your application's PostgreSQL connection through the Emet wire proxy

2. Declare

Select the sensitive columns to protect—PII, credentials, financial data

3. Encrypt

New protected writes are encrypted transparently with AES-256-GCM; existing values can be migrated in place

4. Verify

Confirm your database holds no plaintext for protected columns—there is nothing left to breach