Field Level Encryption

what is field level encryption? field level encryption ensures that only selected fields are encrypted using aes 256 encryption when data is stored in the database this ensures that confidential customer data is securely encrypted at rest while remaining fully transparent to application logic and downstream integrations it allows you to selectively encrypt sensitive fields captured during an onboarding flow other fields remain unaffected encryption happens automatically at save time decryption happens automatically at read time no changes are required in application logic or apis this configuration is flow specific and can be applied independently to different mainflows and subflows where to find this feature admin portal → configurations→grants & config→ field encryption from this section, you can select a flow choose specific fields (variables) enable or disable encryption at a field level how it works select a flow (mainflow or subflow) for which encryption needs to be configured choose the page and the specific field(s) to encrypt save the configuration from that point onward, new data for selected fields is stored in encrypted form using aes 256 supported page types & storage mapping field level encryption supports multiple data sources within go the encryption logic is applied based on where the data is stored mainflow pages collection merchantdata path data \<fieldname> subflow pages collection submerchantdata path data \<fieldname> user initial input collection merchant path \<fieldname> note supported only for mainflows backops custom tabs collection custommerchantdata path user defined paths behavior for live flows field level encryption works seamlessly even for already live flows , with the following behavior encryption starts from the day the configuration is saved existing data before that date remains unchanged removing encryption stops encryption only for new data important notes existing data existing (old) data is not automatically encrypted only data saved after configuration is encrypted to encrypt historical data, those records must be updated after enabling encryption removing fields from encryption removing a field from configuration does not decrypt existing encrypted data previously encrypted values remain encrypted in the database decryption will still work for old encrypted data using stored metadata new data for removed fields will be saved in plain text transparency & performance encryption is fully transparent to application logic apis, rules, workflows, and integrations continue to work as is no performance tuning or schema changes are required when do changes take effect? changes take effect immediately after saving applies only to new data saved after the change no retroactive impact unless data is explicitly updated recommended use cases encrypting sensitive identifiers (pan, aadhaar, account numbers) protecting confidential business information meeting compliance and audit requirements limiting data exposure in database level access