Encryption-in-Use and Searchable Encryption for Postgres Applications

An Australian data-security company, CipherStash builds encryption infrastructure for applications that hold regulated personal information such as health records, financial and insurance data, legal files and government records. Founded by chief executive Dan Draper, who set out the rationale publicly in 2021, and now led alongside chief technology and product officer Lindsay Holmwood, it sells to engineering teams whose customers and auditors demand strong data protection but who cannot afford to lose search, reporting or developer velocity. Investors include AirTree Ventures, Skip Capital, Nexus Venture Partners and Hack VC.

The approach is encryption-in-use: values are encrypted in the application before they reach the database and stay encrypted while being queried. Encrypt Query Language adds custom Postgres types and operators so ciphertext can be indexed and compared directly, supporting equality matches, range queries on encrypted dates and numbers, tokenised text search and nested JSONB lookups through ordinary Postgres indexes. TypeScript SDKs with Drizzle and Prisma plugins cover new code, while a database proxy retrofits existing applications that cannot be changed.

Key handling is the main point of difference. ZeroKMS issues a distinct data key for every encrypted value, derived in application memory from a client-held key plus a short-lived seed, so no per-value key is stored or reused and a batch of a thousand values needs only one round trip. Keysets give cryptographically separated tenants, each value carries an access policy tied to identity providers such as Auth0 and Clerk, and every decryption is recorded in an immutable audit trail. The company reports SOC 2 Type 2 attestation and publishes its cryptographic research.