“Is my data encrypted?” is one of the most common questions we get, and it deserves a real answer rather than a marketing one. Encryption is not a single feature. It is a set of layers, and each layer defends against a different threat. What matters is being precise about which layer does what, and which are live today versus on our roadmap. Here is exactly where WattleDB stands.
What protects your data today
Several protections are live right now, on every database, including the free tier:
- Encryption in transit (TLS). Every connection to WattleDB is encrypted, your application to your database, the console, our REST API, and the replication of your backups to our Melbourne facility. Data moving across a network is never in the clear. This defends against anyone able to observe traffic between you and us, or between our own systems.
- Hashed passwords. Account passwords are never stored in a readable form. They are salted and hashed, so a copy of our user table would reveal nobody's password, and we cannot read them either.
- Physical security and controlled access. Your database and its backups sit in Australian-owned data centres, in Sydney with a cross-state copy in Melbourne. Access to that hardware is physically controlled, and access to your data within our systems is restricted to the operations that keep it running.
- Australian jurisdiction. Because there is no US or other foreign entity in the chain, your data is not exposed to foreign legal process by default. Sovereignty is its own kind of protection.
Encryption at rest: coming soon
Encryption at rest is on our roadmap, and we would rather tell you it is coming than imply it is already here.
What it is. Encryption at rest scrambles the data as it sits on disk, so the raw storage is unreadable without the key.
What it protects against. A drive that is stolen, lost, or decommissioned without being wiped. If a physical disk ever left our facility, its contents would be meaningless. Today that gap is covered by physical security and controlled decommissioning. Encryption at rest adds a second, cryptographic lock on top.
What it does not do, and we want to be honest about this. Encryption at rest does not stop someone who already has legitimate access to a running database. Because WattleDB is managed PostgreSQL, our systems have to be able to read your data to run your queries, take your backups, and restore them. At-rest encryption protects the disk, not the live database. Any provider that tells you otherwise is selling you a feeling, not a control.
The strongest option, and its honest trade-off
There is a stronger form of protection, and it comes with a real cost. If you want a provider that holds nothing usable, even under compulsion, the data has to be encrypted by your application before it reaches us, with keys that only you hold. WattleDB then stores only ciphertext. Our staff, our backups, and any subpoena served on us see gibberish, because we do not have the key.
The trade-off is querying. Exact-match lookups can still work through blind indexes, so logins and searches by email or member number keep working, but you give up partial matches, ranges, and sorting on the encrypted columns, because the database itself never sees the plaintext.
We are building this as an opt-in option for the fields that need it most, so you can apply the strongest protection to your most sensitive data without turning your whole database into an opaque blob. You can see exactly how it stores personal data, and register for early access, on our client-side encryption page. Like encryption at rest, it is coming soon rather than today.
In transit, your data is already encrypted on every connection, including to your backups. Encryption at rest, and optional field-level encryption, are coming soon.
Why we are telling you this now
The honest answer to “is my data encrypted?” is: in transit, yes, everywhere, today; at rest, it is protected by physical security, controlled access, and Australian jurisdiction today, with cryptographic encryption at rest coming before general availability. We would rather you knew the exact shape of that than trusted a single word on a feature list.
If encryption and data residency are on your requirements list, or your next tender asks about them, we are happy to walk through exactly what is live and what is coming. Get in touch, or explore WattleDB at wattledb.com.au.