Transparent Data Encryption

Transparent data encryption (TDE) is an optional feature supported by EDB Postgres Advanced Server and EDB Postgres Extended Server from version 15.

It encrypts any user data stored in the database system. This encryption is transparent to the user. User data includes the actual data stored in tables and other objects as well as system catalog data such as the names of objects.

Architecture diagram

• Overview
  • About TDE
    • How does TDE encrypt data?
    • What’s encrypted with TDE?
    • Why should you use TDE?
  • TDE compatibility
    • Supported database distributions
    • Supported technologies
• Administering
  • Overview
    • Before you begin
    • Initializing a server
    • Migrating data (for existing instances)
    • Tutorials
  • Securing the data encryption key
    • Data encryption key
    • Choosing a mechanism to protect the data encryption key
    • Configuring a wrapping and unwrapping command
    • Providing the wrapping and unwrapping commands to TDE
  • Using TDE initialization options
    • To enable TDE
    • To protect the data encryption key
    • Options reference
  • Working with encrypted files
    • Working with encrypted WAL files
    • Working with encrypted backup files
  • Upgrading a TDE-enabled database
    • Tutorials
  • Tutorials
    • Creating a database with TDE
    • Enabling TDE on an existing EDB Postgres Advanced Server
    • Upgrading PostgreSQL to EDB Postgres Extended Server while enabling TDE
    • Verifying TDE is enabled
• Reference
  • Commands affected by TDE
  • initdb TDE options
    • Option: --data-encryption or -y
    • Option: --key-wrap-command=<command>
    • Option: --key-unwrap-command=<command>
    • Option: --no-key-wrap
    • Option: --copy-key-from=<file>
  • pg_upgrade TDE options
    • Option: --copy-by-block
    • Option: --key-unwrap-command=<command>
  • Limitations
    • FILE_COPY