New Deterministic queryable ciphertext, scheduled compliance reports, and environment-aware licence enforcement. See what's included →
Field-level encryption for .NET · EF Core 8 / 9 / 10

Encryption your database never sees the key to.

The complete data-protection layer for Entity Framework Core: transparent field encryption, ML-powered PII discovery, exfiltration detection, and audit-ready compliance evidence — for teams where control and compliance are non-negotiable.

Explore pricing Contact sales
Your keys, never ours Runs air-gapped DPDP · GDPR Art. 32 ready
The platform

Encrypt it, watch it, prove it.

Four deep-dives into what the package actually does — the cryptography, the measured cost of running it, the exfiltration alerting, and the audit evidence built on top.

Encryption

Authenticated AES-GCM in the EF value converter. Your keys never leave your process, and nothing ever leaves your network.

  • 128-bit auth tag — tampering is detected, not decrypted
  • Fresh 96-bit nonce per value; key-ring rotation with no downtime
  • Blind index and deterministic mode for queryable columns
  • Offline ECDSA licence checks and environment-aware enforcement
Read the security design →

Benchmark

Measured with BenchmarkDotNet on .NET 10, with the benchmark in the repository so you can rerun every number on your own hardware.

  • 3.7–5.8× faster writes than the common AES-CBC pattern
  • Up to 36× faster reads on short identifier fields
  • ~1 µs to write a five-encrypted-field row; ~1M rows/s/core
  • Zero cost for queries and projections that skip encrypted columns
See the benchmarks →

Security Alerts

Crypto Sentinel spots a decryption spike in one second and emails you — before the data has finished leaving.

  • ML spike detection per series, with a hard rate-limit guard
  • Email, HMAC-signed webhook, logger, or any channel you write
  • Retries, digests, dead-lettering and a flush on shutdown
  • Critical alerts bypass the digest and send on the next tick
See what lands in your inbox →

Compliance Report

The audit-ready evidence pack — a dated, signed-off inventory of what's protected and what isn't — writes itself on your schedule.

  • Computed coverage %, encrypted inventory, and open findings
  • Accepted-risk ledger with approver and date
  • Scheduled DPDP / GDPR Art. 32 delivery — HTML + JSON attached
  • Missed-window catch-up and one-report-per-replica de-dup
See the evidence pack →
Pricing

One license. Everything included.

Free for small projects and evaluation. When your project earns more than $2,000 a year, a single flat license unlocks the full platform — no tiers to decode, no per-seat math.

Community
For small projects, OSS & evaluation
Free
under $2,000 annual revenue · 1 developer · commercial license
Get started
  • Field encryption — CBC & AES-GCM
  • All checksum-verified detectors
  • Auto-encryption & blind-index search
  • Custom rules & all attributes
  • Full documentation & community support
1 developer · no expiring activation · same binaries as the paid license.
Enterprise
For growing organizations with no app-count ceiling
$2999 / yr
unlimited developers · unlimited projects
Get your license
  • Everything in Community, org-wide
  • Unlimited developers & unlimited projects
  • ML classifier — names, addresses, free text
  • Crypto Sentinel exfiltration alarm
  • Email, webhook & custom alert channels
  • Compliance evidence pack — JSON + A4 PDF
  • No application count to track, ever
  • Priority support · Less than 1 business-day SLA
One price for your whole portfolio — no add-ons, no usage fees, no per-seat charges.
Most popular
5-Year License
Enterprise, prepaid — lock in today's price
$5999 / 5 yrs
unlimited developers · unlimited projects · one payment, no renewals
Get your license
  • Everything in Enterprise, for 5 years
  • Save $8,996 vs. paying annually
  • Price locked — immune to future increases
  • ML classifier, Crypto Sentinel & alerting
  • Compliance evidence pack — JSON + A4 PDF
  • Priority support · 1-hour response SLA
One invoice covers five years — ideal for budget cycles and long procurement lock-ins.
Compare plans

Everything you need to protect and prove

The capabilities development and compliance teams need to encrypt PII, detect exfiltration, and pass audits.

← swipe to compare →

Capability Community
Free · under $2K/yr
 Enterprise
$2999/yr · unlimited
 5-Year
$5999 · 5 yrs · unlimited
Licensing
Developers Up to 2 Unlimited Unlimited
Projects / applicationsDistinct revenue-generating apps the license covers Up to 1 Unlimited Unlimited
Offline validation & startup enforcementECDSA P-256 signature check with no network call; warns locally, fails an unlicensed cloud deploy at startup ✓ ✓ ✓
Encryption core
AES-GCM authenticated encryptionRandom nonce per value, tamper-detection tag, key-ring rotation ✓ ✓ ✓
Auto-encryption by conventionPII columns encrypt by default; opt-out is the explicit act ✓ ✓ ✓
Blind-index searchFast equality lookups on encrypted columns via keyed-HMAC shadow columns ✓ ✓ ✓
Deterministic modeSynthetic-IV (AES-GCM-SIV style) ciphertext so LINQ equality translates to an index seek ✓ ✓ ✓
Key-ring rotation & tenant bindingKey id in every envelope; associated data pins a value to its tenant ✓ ✓ ✓
Zero-migration upgrade pathExisting CBC data and APIs keep working, unchanged; the CBC→GCM bridge reads both ✓ ✓ ✓
PII discovery
Checksum-verified detectorsAadhaar, Luhn cards, IBAN mod-97, SSN, crypto wallets, IFSC, and more ✓ ✓ ✓
Name heuristics & custom rules140-token vocabulary + your own tokens and regex patterns ✓ ✓ ✓
ML classifierNames, addresses, free-text PII — extensible with your corpus — ✓ ✓
Live-data sampling scanSamples real column values, not just names Names only Full Full
Detection & alerting
Crypto SentinelML spike detection on decryption rates — the exfiltration alarm — ✓ ✓
Email & webhook alertsYour SMTP; HMAC-signed webhooks; digests, retries, dead-letter — ✓ ✓
Custom alert channelsSIEM, Slack, PagerDuty, and any IAlertChannel — ✓ ✓
Compliance
Compliance evidence packInventory, coverage, findings, alert history — JSON + print-ready A4 — ✓ ✓
Scheduled report deliveryDaily, weekly or monthly in your time zone — generated and emailed with both formats attached — ✓ ✓
Missed-window catch-up & replica de-duplicationA window missed during a deploy is sent late, and three pods send one report between them — ✓ ✓
Accepted-risk exemption ledgerEvery deliberate plaintext decision, with sign-off — ✓ ✓
Support
Support channel Community Priority Priority
Response SLA — Less than 1 business days Within 1 hour
Due diligence

Frequently asked questions

The questions your security review and procurement teams will ask — answered up front.

Who holds the encryption keys?
You, exclusively. The library has no code path that generates, stores, or transmits key material. You construct the provider with a key from your own vault (Azure Key Vault, AWS KMS, HashiCorp Vault) — without it, nothing encrypts. Blind indexes use a second, independently rotatable key, also yours.
Does anything leave our network?
Only the SMTP and webhook traffic you configure, to endpoints you own. License validation is fully offline via an ECDSA signature check — no activation server, no telemetry, no vendor cloud. It runs air-gapped.
When exactly do I need a license?
The moment the project using the library earns more than $2,000 in annual revenue. Below that — plus all development, testing, and personal projects — it's free. Above it, a single flat $2999/year Enterprise license covers unlimited developers and unlimited applications, priced per organization with no per-seat counting.
We already use the free version — what changes?
Nothing technical. The paid license unlocks the ML classifier, Sentinel, alerting, and compliance features — same package, same APIs, same encrypted data. Once your project crosses $2,000 in annual revenue you add a license key; your code doesn't change and there is no migration, ever.
What happens when a license expires?
In local development it degrades to the free Community tier with a clear warning. In production it fails fast so an unlicensed deployment is caught immediately. Either way, your data stays encrypted and readable — expiry never risks your data.
Can we verify what the code does?
Yes — the package ships readable, documented C# with ~50 unit tests including published checksum vectors (ISO IBAN, BIP-173, Luhn). Your security team can read every line that touches your data. Full source is available to licensees on request.
Can I upgrade or change plans later?
Anytime. We issue a new license for the updated term with prorated credit for the unused portion of your existing license. Downgrades apply at renewal.
Sales Inquiries

Contact an expert

Please answer the questions below to help our team assist you more effectively.

  • Enterprise licensing, volume, and renewal questions
  • Security review, compliance, and rollout support

Our team will respond to your request within 1 business day.