--- title: Temporal Proxy: centralized payload encryption for... description: Temporal Proxy centralizes Workflow payload encryption for Temporal Cloud using keys you control. Deployed in your own environment, it sits between your... canonical: https://daily.dev/posts/temporal-proxy-centralized-payload-encryption-for-temporal-cloud-rydqfzxa7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Temporal Proxy: centralized payload encryption for Temporal Cloud | daily.dev og:description: Temporal Proxy centralizes Workflow payload encryption for Temporal Cloud using keys you control. Deployed in your own environment, it sits between your... og:url: https://daily.dev/posts/temporal-proxy-centralized-payload-encryption-for-temporal-cloud-rydqfzxa7 og:image: https://api.daily.dev/og/posts/rydQFZXA7.png og:image:alt: Temporal Proxy: centralized payload encryption for Temporal Cloud og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Temporal Proxy: centralized payload encryption for Temporal Cloud **[Temporal](https://daily.dev/sources/temporal)** · 4 min read · 0 upvotes · 0 comments ## Summary Temporal Proxy centralizes Workflow payload encryption for Temporal Cloud using keys you control. Deployed in your own environment, it sits between your Workers and Temporal Cloud, encrypting payloads like customer emails or payment details over mTLS before they reach Temporal Cloud. It supports AWS KMS, Google Cloud KMS, Azure Key Vault, or custom key-management backends, using envelope encryption with a short-lived AES-256-GCM data key. Temporal Cloud stores only ciphertext and a protected data key, which it cannot decrypt. Search Attributes remain unencrypted, and the tool is in Public Preview, fully supported for production. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Temporal Proxy encrypt Workflow payloads before they reach Temporal Cloud? Temporal Proxy uses envelope encryption: a short-lived data key encrypts the payload with AES-256-GCM, and a key-management service (AWS KMS, Google Cloud KMS, Azure Key Vault, or custom backend) protects that data key with a key you control. The protected data key travels alongside the encrypted payload, and Temporal Cloud stores both but cannot decrypt them. _Teams evaluating payload encryption for Temporal Cloud can compare approaches like this on daily.dev._ ### Does Temporal Proxy encrypt Search Attributes in Temporal Cloud? No, Search Attributes, the searchable metadata used to find Workflow executions, remain unencrypted even when payload encryption is enabled. Only application payloads and, optionally, error messages and stack traces are protected. Enabling encryption also does not retroactively encrypt data already stored in Temporal Cloud. _Developers configuring Temporal security controls can track rollout details like this on daily.dev._ ## Similar posts on daily.dev - [Temporal reveals serverless option for its Durable Execution platform](https://daily.dev/posts/temporal-reveals-serverless-option-for-its-durable-execution-platform-o3rnnfwsf) · The New Stack · 2 upvotes · 0 comments - [End-to-end encryption for Vercel Workflow](https://daily.dev/posts/end-to-end-encryption-for-vercel-workflow-0r6jv9cyy) · Vercel · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/temporal-proxy-centralized-payload-encryption-for-temporal-cloud-rydqfzxa7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Temporal Proxy: centralized payload encryption for Temporal Cloud","url":"https://daily.dev/posts/temporal-proxy-centralized-payload-encryption-for-temporal-cloud-rydqfzxa7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/temporal-proxy-centralized-payload-encryption-for-temporal-cloud-rydqfzxa7"},"datePublished":"2026-10-27T13:07:33.426Z","dateModified":"2026-10-27T13:08:01.519Z","description":"Temporal Proxy centralizes Workflow payload encryption for Temporal Cloud using keys you control. Deployed in your own environment, it sits between your...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/86c11a05efbfc4f370c28a134f6518d4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/86c11a05efbfc4f370c28a134f6518d4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Temporal","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Temporal","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/65290ca7e3ab46a7b1df76f2757800c2","url":"https://daily.dev/sources/temporal"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/temporal-proxy-centralized-payload-encryption-for-temporal-cloud-rydqfzxa7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,encryption","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Temporal","item":"https://daily.dev/sources/temporal"},{"@type":"ListItem","position":3,"name":"Temporal Proxy: centralized payload encryption for Temporal Cloud"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/temporal-proxy-centralized-payload-encryption-for-temporal-cloud-rydqfzxa7#faq","mainEntity":[{"@type":"Question","name":"How does Temporal Proxy encrypt Workflow payloads before they reach Temporal Cloud?","acceptedAnswer":{"@type":"Answer","text":"Temporal Proxy uses envelope encryption: a short-lived data key encrypts the payload with AES-256-GCM, and a key-management service (AWS KMS, Google Cloud KMS, Azure Key Vault, or custom backend) protects that data key with a key you control. The protected data key travels alongside the encrypted payload, and Temporal Cloud stores both but cannot decrypt them. Teams evaluating payload encryption for Temporal Cloud can compare approaches like this on daily.dev."}},{"@type":"Question","name":"Does Temporal Proxy encrypt Search Attributes in Temporal Cloud?","acceptedAnswer":{"@type":"Answer","text":"No, Search Attributes, the searchable metadata used to find Workflow executions, remain unencrypted even when payload encryption is enabled. Only application payloads and, optionally, error messages and stack traces are protected. Enabling encryption also does not retroactively encrypt data already stored in Temporal Cloud. Developers configuring Temporal security controls can track rollout details like this on daily.dev."}}]} ```