--- title: Searchable field-level encryption on Supabase with... description: CipherStash is now integrated with Supabase, bringing Data Level Access Control (DLAC) and searchable field-level encryption to Postgres-backed applications.... canonical: https://daily.dev/posts/searchable-field-level-encryption-on-supabase-with-cipherstash-osxmbdyzi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Searchable field-level encryption on Supabase with CipherStash | daily.dev og:description: CipherStash is now integrated with Supabase, bringing Data Level Access Control (DLAC) and searchable field-level encryption to Postgres-backed applications.... og:url: https://daily.dev/posts/searchable-field-level-encryption-on-supabase-with-cipherstash-osxmbdyzi og:image: https://api.daily.dev/og/posts/osXmBDyzi.png og:image:alt: Searchable field-level encryption on Supabase with CipherStash og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Searchable field-level encryption on Supabase with CipherStash **[Supabase](https://daily.dev/sources/supabase)** · 3 min read · 0 upvotes · 0 comments ## Summary CipherStash is now integrated with Supabase, bringing Data Level Access Control (DLAC) and searchable field-level encryption to Postgres-backed applications. Unlike traditional field-level encryption that breaks SQL queries, CipherStash stores encrypted values alongside Searchable Encrypted Metadata (SEM), allowing WHERE clauses, ORDER BY, fuzzy matching, and joins to work on encrypted data. Each value gets a unique encryption key managed through ZeroKMS, a zero-knowledge key management service, meaning neither CipherStash nor Supabase can access plaintext data. Setup requires a single CLI command and no schema changes. The integration supports TypeScript apps via Supabase.js, Drizzle, and Prisma, and also offers a Postgres wire-protocol proxy for non-SDK use cases. Particularly relevant for teams under HIPAA, GDPR, SOC 2, FedRAMP, or IL4 compliance requirements. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I search encrypted fields in Postgres without decrypting the data first? CipherStash's integration with Supabase stores each encrypted value as a JSON payload containing ciphertext plus Searchable Encrypted Metadata (SEM). Postgres matches queries against the stored SEM rather than plaintext, so WHERE clauses, fuzzy text matching, ORDER BY, and JSON queries work directly over encrypted columns without pulling data into the application to decrypt and filter in memory. _daily.dev surfaces integration approaches like this for teams weighing encryption against searchability in Postgres._ ### How do I add field-level encryption to a Supabase project without changing my database schema? Install the CipherStash integration with a single CLI command, npx stash init --supabase, which wraps the Supabase SDK to transparently encrypt and decrypt marked columns at the application layer. It works natively with Supabase.js, Drizzle, and Prisma, and keys are managed per value through ZeroKMS, CipherStash's zero-knowledge key management service, so no schema migration is required. _Developers adding compliance-grade encryption to existing databases can track setups like this via daily.dev._ ### How can teams handle encrypted database access from tools that don't support an application SDK, like analytics jobs or SQL clients? CipherStash Proxy acts as a secure escape hatch by speaking the Postgres wire protocol directly, transparently handling encryption and decryption so existing SQL clients, admin tooling, and background workers in other languages can query encrypted data without any code changes. _daily.dev helps developers stay on top of tooling that bridges encrypted databases and legacy or cross-language workflows._ ## Similar posts on daily.dev - [Search encrypted data with Prisma 8 and CipherStash](https://daily.dev/posts/search-encrypted-data-with-prisma-8-and-cipherstash-zxv5oz78e) · Prisma Blog · 0 upvotes · 0 comments - [Sync Stripe data to your Supabase database in one click](https://daily.dev/posts/sync-stripe-data-to-your-supabase-database-in-one-click-txhqexv9m) · Supabase · 41 upvotes · 0 comments - [Building Secure PII Encryption at Scale](https://daily.dev/posts/building-secure-pii-encryption-at-scale-inswd0air) · Halodoc · 31 upvotes · 1 comments --- Tags: [#postgresql](https://daily.dev/tags/postgresql), [#supabase](https://daily.dev/tags/supabase) [View this post on daily.dev](https://daily.dev/posts/searchable-field-level-encryption-on-supabase-with-cipherstash-osxmbdyzi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Searchable field-level encryption on Supabase with CipherStash","url":"https://daily.dev/posts/searchable-field-level-encryption-on-supabase-with-cipherstash-osxmbdyzi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/searchable-field-level-encryption-on-supabase-with-cipherstash-osxmbdyzi"},"datePublished":"2026-07-09T09:00:19.854Z","dateModified":"2026-09-13T20:03:27.475Z","description":"CipherStash is now integrated with Supabase, bringing Data Level Access Control (DLAC) and searchable field-level encryption to Postgres-backed applications....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/52845d1bb492f82582c340a3ec0956c6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/52845d1bb492f82582c340a3ec0956c6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Supabase","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Supabase","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/d0aa77cfb88d44dd8e6d5cd02fdf80bd","url":"https://daily.dev/sources/supabase"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/searchable-field-level-encryption-on-supabase-with-cipherstash-osxmbdyzi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"postgresql,supabase","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Supabase","item":"https://daily.dev/sources/supabase"},{"@type":"ListItem","position":3,"name":"Searchable field-level encryption on Supabase with CipherStash"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/searchable-field-level-encryption-on-supabase-with-cipherstash-osxmbdyzi#faq","mainEntity":[{"@type":"Question","name":"How can I search encrypted fields in Postgres without decrypting the data first?","acceptedAnswer":{"@type":"Answer","text":"CipherStash's integration with Supabase stores each encrypted value as a JSON payload containing ciphertext plus Searchable Encrypted Metadata (SEM). Postgres matches queries against the stored SEM rather than plaintext, so WHERE clauses, fuzzy text matching, ORDER BY, and JSON queries work directly over encrypted columns without pulling data into the application to decrypt and filter in memory. daily.dev surfaces integration approaches like this for teams weighing encryption against searchability in Postgres."}},{"@type":"Question","name":"How do I add field-level encryption to a Supabase project without changing my database schema?","acceptedAnswer":{"@type":"Answer","text":"Install the CipherStash integration with a single CLI command, npx stash init --supabase, which wraps the Supabase SDK to transparently encrypt and decrypt marked columns at the application layer. It works natively with Supabase.js, Drizzle, and Prisma, and keys are managed per value through ZeroKMS, CipherStash's zero-knowledge key management service, so no schema migration is required. Developers adding compliance-grade encryption to existing databases can track setups like this via daily.dev."}},{"@type":"Question","name":"How can teams handle encrypted database access from tools that don't support an application SDK, like analytics jobs or SQL clients?","acceptedAnswer":{"@type":"Answer","text":"CipherStash Proxy acts as a secure escape hatch by speaking the Postgres wire protocol directly, transparently handling encryption and decryption so existing SQL clients, admin tooling, and background workers in other languages can query encrypted data without any code changes. daily.dev helps developers stay on top of tooling that bridges encrypted databases and legacy or cross-language workflows."}}]} ```