Date: Thu, 13 Mar 2025 19:37:14 +0100
From: Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
To: Ron Johnson <ronljohnsonjr@gmail.com>
Cc: "pgsql-generallists.postgresql.org" <pgsql-general@lists.postgresql.org>
Subject: Re: hide data from admins
Message-ID: <20250313193714.27810bba@karst>
In-Reply-To: <CANzqJaBUFoVZw+AS9Rc4OQ67NNzzsPdLvD2SSb8J9KpR=kXogQ@mail.gmail.com>
References: <CAC5iy63SkK=C2f4Z+C9110brQPKEGLxpOn8fLnPs4A2vsMmpAA@mail.gmail.com>
	<CANzqJaBUFoVZw+AS9Rc4OQ67NNzzsPdLvD2SSb8J9KpR=kXogQ@mail.gmail.com>
Organization: Dalibo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/20250313193714.27810bba%40karst>
Precedence: bulk

Le Tue, 11 Mar 2025 22:03:50 -0400,
Ron Johnson <ronljohnsonjr@gmail.com> a =C3=A9crit :

> On Tue, Mar 11, 2025 at 9:48=E2=80=AFPM Siraj G <tosiraj.g@gmail.com> wro=
te:
>=20
> > Hello Experts!
> >
> > What are the features available in Postgresql to hide PII (personal
> > identifiable information) from the Admin team? Like in Oracle we have d=
ata
> > vault and data redaction, I am looking for similar features in
> > PostgreSQL.We do not want to do code level changes.
>=20
> Look at pgsodium.  However, "no code level changes" is code for at-rest
> encryption.

Unless I'm wrong, pgsodium will not protect you from Admin team. The "postg=
res"
role will always be able to read your keys or meta-data to derive them from=
 the
master key if they are stored inside the database=E2=80=A6 and root might b=
e able to
scan the memory to find the master key I suppose.

Storing the keys outisde the database means code level change.

Your best bet would be the Transparent Column Encryption patch, but it is
stalled for one year.

In last resort, I suppose selinux/sepgsql machinery can lock everything the=
 way
you want, even without encryption=E2=80=A6

good luck.