Field-Level Encryption (FLE)

FLE encrypts specific document fields on the client before the data reaches Couchbase Server. The server stores ciphertext — it never sees plaintext for encrypted fields. Decryption happens on the client when reading.

When to Use FLE

• Regulatory compliance (PCI-DSS, HIPAA, GDPR) requiring field-level protection
• Encrypting PII (SSNs, credit card numbers, health data) while keeping other fields queryable
• Multi-tenant environments where different tenants need different encryption keys

FLE is not a substitute for TLS (in-transit encryption) or server-side encryption at rest — use all three for defence in depth.

How It Works

1. Configure a CryptoManager with a KeyProvider that holds your encryption keys.
2. Register the CryptoManager with the cluster at connection time.
3. Annotate fields (or specify field names at write time) to encrypt.
4. On upsert, the SDK encrypts annotated fields and stores them as {"alg":"...", "ciphertext":"..."} objects.
5. On get, the SDK decrypts annotated fields transparently.