Architecture
How the field-level encryption API works
You keep the encrypted value. We keep the keys. Neither side is enough on its own.
What you send
A plaintext string — an SSN, an email, a JSON blob. You do not send keys.
What you get back
One envelope — a single string that starts with envelope. Store it where the private string used to live.
Why the split matters
If your database is copied, the attacker has envelopes without keys. If our side is copied, they do not have your values.
What this is not
Not format-preserving tokenization. Not a PCI card vault. Not a SOC 2 report on day one.