Cryptex DB
Cryptex DB — Encrypted Database with Virtual HSM
Cryptex DB is the secure data layer of the Smartex Money platform. It provides field-level encryption for sensitive data — card numbers, PII, credentials, and transaction details — using a virtual Hardware Security Module (HSM) that keeps encryption keys within a hardened boundary. Full compliance with PCI DSS data-at-rest requirements and GDPR data protection principles.
Unlike application-level encryption that exposes keys in memory, Cryptex DB operates at the database engine level, ensuring that even database administrators cannot access encrypted fields without proper authorization. Keys never leave the HSM boundary — all cryptographic operations happen inside the virtual HSM.
Security Architecture
Field-Level Encryption
Individual database fields encrypted with AES-256-GCM. Encrypt only what needs protection — performance impact limited to sensitive fields, not the entire database.
Virtual HSM
Software-based Hardware Security Module compliant with FIPS 140-2 Level 3. Key generation, storage, and cryptographic operations all happen inside the HSM boundary. Keys never exposed in plaintext.
Key Management
Automatic key rotation with configurable schedules. Master keys, data encryption keys, and key encryption keys — a three-tier hierarchy that limits blast radius of any compromise.
Access Control
Column-level access permissions integrated with Smartex SSO. Database admins can manage schema without seeing encrypted data. Application access via API tokens with scoped permissions.
Tamper Detection
Cryptographic integrity verification detects unauthorized modifications. HMAC-based authentication on every encrypted field. Tampering attempts logged and alerted in real time.
Data Masking
Automatic PII masking for non-production environments. Partial masking (show last 4 digits) for display. Configurable masking rules per role and field type.
Compliance & Standards
PCI DSS
Full compliance with Payment Card Industry Data Security Standard. Card data encrypted at rest with strong cryptography. Key management meets PCI DSS requirements 3.1–3.6.
GDPR
Personal data encrypted at rest and in transit. Right to erasure supported through cryptographic deletion — destroy the key and the data becomes permanently unreadable.
FIPS 140-2
Virtual HSM validated to FIPS 140-2 Level 3 standard. Approved cryptographic algorithms: AES-256-GCM, RSA-4096, ECDSA-P384, SHA-3.
ISO 27001
Aligned with ISO/IEC 27001 information security management. Encryption policies, key management procedures, and access controls documented and auditable.
SOX
Sarbanes-Oxley compliant audit trails for all data access and modifications. Cryptographic proof of data integrity for financial reporting.
GLBA
Gramm-Leach-Bliley Act safeguards rule compliance. Customer financial information protected through encryption, access controls, and audit logging.
Integration with Smartex Platform
Native Integration
All Smartex Money modules use Cryptex DB as their data layer. Sensitive fields in ABS Core (account numbers, balances), On-Board CRM (identity documents, PEP status), Loan Farm (credit scores, collateral details), and ADS Engine (fraud scores) are encrypted automatically.
Developer API
Transparent encryption API — developers mark fields as sensitive in the schema and Cryptex DB handles the rest. No code changes needed for encryption. Query encrypted fields with same SQL syntax.
Multi-Region Keys
Different encryption keys per region or per tenant. SaaS deployments can offer cryptographic isolation between clients. Keys can be pinned to specific geographic regions for data sovereignty.
Key Versioning
Historical key versions retained for decrypting old data. Automatic re-encryption with new keys when data is updated. Configurable retention for old keys to meet audit requirements.
Performance & Scalability
Low Overhead
AES-NI hardware acceleration on modern CPUs. Encryption overhead: less than 3% for typical queries. Hot data cached in plaintext within the HSM boundary for fast access.
Horizontal Scaling
Virtual HSM instances scale horizontally. Read replicas share encrypted data without key replication. Per-shard HSM instances for large deployments.
Backup Encryption
All database backups encrypted with separate backup keys. Backup keys managed independently from production keys — compromise of one does not affect the other.
Protect your most sensitive data
Cryptex DB ensures that even in a worst-case breach, your encrypted data stays protected. Schedule a demo to see how field-level encryption and virtual HSM technology can secure your FinTech infrastructure.
Request a Demo