Transparent data encryption (TDE) is an optional feature supported by Enterprise Postgres (Oracle Compatible), formerly EDB Postgres Advanced Server, and Enterprise Postgres, formerly EDB Postgres Extended Server, from version 15.
It encrypts any user data stored in the database system, including the data in tables and other objects as well as system catalog data such as object names. This encryption is transparent to the user, requiring no changes to applications or client drivers, and it protects sensitive data at rest to support common data privacy and security compliance requirements.
Overview
Learn about TDE, how it works, what it encrypts, and why to use it.
Setting up TDE
Choosing a key protection mechanism
Learn how to secure your data with an encryption key.
Creating a new cluster
Understand how to initialize a TDE-encrypted cluster on a self-managed database server.
Upgrading and encrypting
Learn about the supported pg_upgrade use cases for enabling TDE, migrating to TDE, and upgrading TDE-enabled databases.
Migrating from PostgreSQL
Use pg_upgrade to move a community PostgreSQL cluster to Enterprise Postgres (Oracle Compatible) or Enterprise Postgres while enabling TDE.
Operating TDE
Maintaining the data encryption key
Learn how to protect or rotate the data encryption key on an already TDE-enabled cluster.
Working with encrypted files
How to work with files in an encrypted environment.
Reference
Reference material for TDE, including commands affected by TDE, initdb, pg_upgrade, WAL file, and backup file options, limitations, and how to verify TDE is enabled.