Sealed ciphertext store
The Reliquary
The Reliquary keeps documents as sealed text: every field is encrypted on your side before it reaches Zipper, under its own per-document key that is wrapped by your workspace key (AES-256-GCM). Queries still work because rows are found by blind equality tokens — a keyed fingerprint of the value, never the value itself — and range lookups bucket the token so a search stays coarse. A custodian seal lets a named, logged, time-boxed key open a record when you must, and key rotation runs in the background, resealing old keys as it passes. The Studio view shows sealed columns as ciphertext — a zero-knowledge display, not zero-knowledge execution. Honest limits, stated plainly: access patterns leak (row counts and timing survive encryption), blind indexes serve equality and coarse ranges only — no arbitrary joins or ordering over sealed columns — and zero-knowledge is a direction, not a promise. Not SQL Server Always Encrypted, not a confidential-compute cluster, and not a secrets vault — this is your document store with the operator locked out of the contents. Included on every Zipper plan.
Cloudflare analogue: encrypted document store
What it is
The Reliquary keeps documents as sealed text: every field is encrypted on your side before it reaches Zipper, under its own per-document key that is wrapped by your workspace key (AES-256-GCM). Queries still work because rows are found by blind equality tokens — a keyed fingerprint of the value, never the value itself — and range lookups bucket the token so a search stays coarse. A custodian seal lets a named, logged, time-boxed key open a record when you must, and key rotation runs in the background, resealing old keys as it passes. The Studio view shows sealed columns as ciphertext — a zero-knowledge display, not zero-knowledge execution. Honest limits, stated plainly: access patterns leak (row counts and timing survive encryption), blind indexes serve equality and coarse ranges only — no arbitrary joins or ordering over sealed columns — and zero-knowledge is a direction, not a promise. Not SQL Server Always Encrypted, not a confidential-compute cluster, and not a secrets vault — this is your document store with the operator locked out of the contents.
Closest analogue: encrypted document store. SLA 99.95% · p99 75ms. Admins grant custodian seals. Operators query sealed documents. Every seal use is audited.
- ▸Field-level envelope encryption before upload
- ▸Blind equality and coarse range indexes
- ▸Zero-knowledge Studio view of sealed columns
- ▸Custodian seals — named, logged, time-boxed
- ▸Background key rotation
- ▸Honest limits stated in the copy
How it works
Your app seals every field before it leaves: each document gets its own key, and that key is wrapped by your workspace key (AES-256-GCM). What reaches Zipper is sealed text.
Queries still find rows because lookups go through blind equality tokens — a keyed fingerprint of the value. The raw value never travels with the query.
Range lookups bucket the token so a search stays coarse; you choose how coarse. Custodian seals open a record only when a named person, for a logged, time-boxed reason.
Rotation reseals old envelope keys in the background. The Studio view shows sealed columns as ciphertext — a zero-knowledge display, not zero-knowledge execution.
Honest limits: access patterns leak (row counts and timing survive encryption), blind indexes serve equality and coarse ranges only — no arbitrary joins or ordering over sealed columns.
Use cases
Concrete ways teams use this service on day one.
Store records the operator cannot read
A health startup must keep patient notes encrypted so no administrator, including its host, can read them.
- Seal each field in the browser or app before POSTing the document.
- Query with blind equality tokens on the fields you filter by; coarse buckets for ranges.
- Grant a custodian seal to a named clinician when record access is required — every use is audited and expires.
Move off a plain document database
A team already stores JSON documents but wants ciphertext at rest without rewriting query logic.
- Re-shape existing documents into field-sealed form with the import hatch.
- Switch equality filters to blind tokens; keep ranges coarse.
- Enable rotation so old envelope keys reseal on schedule.
Set it up in the dashboard
Dashboard → Database → The Reliquary → Overview: sealed documents, index health, rotation age.
Documents tab: browse ciphertext and per-field seals; Studio shows sealed columns as they are stored.
Seals tab: issue, log, and expire custodian seals — each shows who, which record, and until when.
Configure tab: range bucketing, rotation interval, and custodian seals (sealing and blind indexes are always on).
Rotate now: reseal outstanding envelope keys without downtime.
API
Control-plane: GET|PATCH /api/v1/services/reliquary. Send Authorization: Bearer tz_live_YOUR_TOKEN.
Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.
Read Reliquary configuration
curl -sS https://tinyzipper.com/api/v1/services/reliquary \ -H "Authorization: Bearer tz_live_YOUR_TOKEN"
Tighten range bucketing and rotation
curl -sS -X PATCH https://tinyzipper.com/api/v1/services/reliquary \
-H "Authorization: Bearer tz_live_YOUR_TOKEN" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"rangeGranularity":"coarse","rotationDays":30}'List the same resource in JavaScript
const res = await fetch("https://tinyzipper.com/api/v1/services/reliquary", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
"Content-Type": "application/json"
}
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);Tips
Sealing happens on your side — if a field is not sealed before upload, it arrives as plain text.
Blind indexes answer equality and coarse ranges; design around that instead of fighting it.
Cardinality of indexed values is visible in the index — treat low-cardinality columns accordingly.
Zero-knowledge is a direction, not a promise: the Studio view is sealed-by-display, queries still reveal shape.
Need relational SQL with ledger proofs? That is The Cellar and The Mint.
- ▸SOC 2
- ▸AES-256-GCM
- ▸Blind indexes
Runbook
Documents are sealed field by field before they reach Zipper; queries find rows by blind equality tokens and bucketed range tokens. Custodian seals open a record only when named, logged, and time-boxed. Rotation reseals old envelope keys in the background. Access patterns still leak — keep coarse ranges and expect no arbitrary joins over sealed columns.
Next: Zipper Pilot · All docs · Create a free account