Why should you care?

PostgresVerse stores UPI tokens — pgcrypto column encryption plus disk encryption meets PCI-style expectations.

See it live — copy this example

Run in pgAdmin or psql.

CREATE EXTENSION IF NOT EXISTS pgcrypto;

CREATE TABLE payment_tokens (
  token_id bigserial PRIMARY KEY,
  customer_id bigint,
  pan_enc bytea NOT NULL
);

INSERT INTO payment_tokens (customer_id, pan_enc)
VALUES (1, pgp_sym_encrypt('4111111111111111', 'vault-key-from-kms'));

SELECT pgp_sym_decrypt(pan_enc, 'vault-key-from-kms') FROM payment_tokens WHERE token_id = 1;

What happened?

• pgp_sym_encrypt stores ciphertext in bytea.
• Key must come from vault not hardcoded in prod.
• Decrypt only in controlled backend function.

Practice next

1. CREATE EXTENSION pgcrypto.
2. Insert encrypted PAN sample with dev key.
3. Decrypt in psql lab only.
4. Use pgp_pub_encrypt asymmetric pattern for batch jobs.
5. Store hash for lookup, encrypt for display-only fields.

Remember

pgcrypto for column-level symmetric encryption. Disk encryption is infra provider responsibility. Keys in KMS/HSM not database.

PostgresVerse token vault

Payment service decrypts only in HSM-backed worker; DB stores bytea ciphertext.

Outcome: DBA snapshot leak exposes useless bytes without key.