BETA
☰

soma-vault

shipped

Envelope encryption on Postgres — a vault without the cluster.

Routes
46
Applied migrations
8
Ciphers
GCM+KWAES-256
Unsafe code
0#![forbid]
soma-vault envelope encryption: a master key derives per-tenant KEKs via HKDF-SHA256; each KEK wraps per-secret DEKs with AES-KW; DEKs encrypt secrets with AES-256-GCM into Postgres master key never leaves config HKDF-SHA256 per-tenant info tenant KEK one per tenant AES-KW wraps DEK one per secret AES-256-GCM ciphertext + wrapped DEK, in Postgres transit encryption API JSON Schema validation pure-Rust crypto · no OpenSSL What's stored is the wrapped DEK and the ciphertext — unwrapping happens in memory, per request.

In the box

  • →Envelope encryption: per-tenant KEKs via HKDF, per-secret DEKs wrapped with AES-KW
  • →Transit encryption API — encrypt/decrypt without storing
  • →JSON Schema validation of secret shape at write time
  • →Pure-Rust crypto stack — no OpenSSL anywhere in the build graph
← All of SOMA-ControlSource on GitHub →