Contents
pg_vault_tde
Transparent Data Encryption (TDE) for PostgreSQL 17+.
pg_vault_tde is a PostgreSQL extension that transparently encrypts table data
at rest, with zero modifications to PostgreSQL core. It plugs in as a Table
Access Method (encrypted_heap) and an Index Access Method (tde_btree):
every tuple is encrypted with AES-256-GCM before it reaches the storage
manager, and decrypted after it leaves — application queries never change.
Encryption keys are managed by HashiCorp Vault / OpenBao, a local PKCS#12 wallet, or a PKCS#11 hardware security module (HSM), and are cached in shared memory with support for online rotation.
This wiki is the operational reference for DBAs and DevOps/platform
engineers who install, configure, and run pg_vault_tde in production. It
does not cover the C internals of the extension itself (see
doc/pg_vault_tde.md in the source repository if you need to modify the
extension’s code).
At a Glance
| Current release | v1.7 |
| PostgreSQL 17 | ✅ Supported |
| PostgreSQL 18 | ✅ Supported |
| PostgreSQL 19 | 🔜 Planned |
| Tuple encryption | AES-256-GCM |
| Index key encryption | AES-256-SIV (equality-only) |
| Key backends | HashiCorp Vault / OpenBao, local PKCS#12 wallet, PKCS#11 / HSM |
| License | BSD (PostgreSQL License) |
Where Do I Start?
- Never used pg_vault_tde before? Start with Installation, then Getting Started.
- Choosing how to store your encryption keys? Read Key Management Overview.
- Preparing for a production rollout? Read Security Considerations, Backup and Restore, and Auditing and Monitoring.
- Something isn’t behaving as expected? Check Known Limitations and Troubleshooting.
- Looking for an exact parameter or function signature? Jump straight to GUC Reference or SQL Function Reference.
Documentation Map
Setup
- Installation — package/source install,
shared_preload_libraries,CREATE EXTENSION - Getting Started — your first encrypted table, end to end
Key Management
- Key Management Overview — provider comparison, DEK/KEK model, multi-tenant configuration
- KMS: HashiCorp Vault / OpenBao
- KMS: Local Wallet
- KMS: PKCS#11 / HSM
- Key Rotation — DEK and KEK rotation runbook
Using Encryption
- Encrypted Tables and Indexes —
encrypted_heap,tde_btree, what’s encrypted and what isn’t - Logical Replication — publishing encrypted tables to subscribers
Operations
- Backup and Restore —
pg_dump_tde,pg_basebackup_tde, key sealing, standby setup - Auditing and Monitoring — audit log format, health checks, SIEM integration
- Performance and Tuning — expected overhead, hardware acceleration
- Security Considerations — threat model and hardening checklist
Reference
- GUC Reference — every configuration parameter
- SQL Function Reference — every SQL-callable function
- Compatibility and Versioning — PostgreSQL/OpenSSL support matrix, upgrade notes
- Known Limitations and Troubleshooting
- Glossary — DEK, KEK, AAD, and other terms used throughout this wiki
License & Copyright
BSD License (PostgreSQL License). Compatible with MIT, BSD, ISC, and Apache 2.0; not derived from any GPL/AGPL-licensed code.
Copyright © 2026 Miriade S.r.l.