Database

pgsodium (pending deprecation): Encryption Features

Supabase DOES NOT RECOMMEND any new usage of pgsodium.

The pgsodium extension is expected to go through a deprecation cycle in the near future. We will reach out to owners of impacted projects to assist with migrations away from pgsodium once the deprecation process begins.

pgsodium is a Postgres extension which provides SQL access to libsodium's high-level cryptographic algorithms.

Supabase previously documented two features derived from pgsodium. Namely Server Key Management and Transparent Column Encryption. At this time, we do not recommend using either on the Supabase platform due to their high level of operational complexity and misconfiguration risk.

Note that Supabase projects are encrypted at rest by default which likely is sufficient for your compliance needs e.g. SOC2 & HIPAA.

Get the root encryption key for your Supabase project

Encryption requires keys. Keeping the keys in the same database as the encrypted data would be unsafe. For more information about managing the pgsodium root encryption key on your Supabase project see encryption key location. This key is required to decrypt values stored in Supabase Vault and data encrypted with Transparent Column Encryption.

Resources

Resources