Encryption
How Datatape encrypts credentials at rest and in transit, and what data is stored.
Encryption
Datatape encrypts sensitive data at every layer — at rest in the database, in transit between services, and when storing API key material.
Credentials at rest
Database connection credentials (host, port, username, password) are encrypted before being stored using Fernet symmetric encryption:
| Property | Detail |
|---|---|
| Algorithm | AES-128-CBC |
| Integrity | HMAC-SHA256 |
| Key management | Server-side encryption key, rotatable |
| Encoding | Base64 URL-safe |
Fernet guarantees that encrypted data cannot be read or tampered with without the encryption key. Each credential is encrypted as a single Fernet token.
Credentials are never returned in API responses, never logged, never included in error messages, and never accessible to AI agents calling your MCP tools.
Data in transit
All communication is encrypted with TLS:
| Connection | Encryption |
|---|---|
| Browser to Datatape | TLS 1.2+ (HTTPS) |
| AI client to MCP endpoint | TLS 1.2+ (HTTPS) |
| Datatape to your database | SSL/TLS (configurable per source) |
| Internal service communication | TLS 1.2+ |
Agent API key storage
Agent API keys are never stored in plain text. When you create an agent, a key is generated:
- The full key (
dt_live_...) is shown to you once at agent creation time - A SHA-256 hash of the key is stored in the database
- A hint (first 3 + last 4 characters) is stored for identification
When a request arrives with an agent API key, Datatape hashes the provided key and compares it against stored hashes. The original key cannot be recovered from the hash.
Stored: sha256(dt_live_a1b2...o5p6) → 9f86d0...
Hint: dt_...o5p6
Raw key: Not stored anywhere
What Datatape stores
| Data | Stored | Encrypted |
|---|---|---|
| Database credentials | Yes | Yes (Fernet) |
| Agent API keys | Hash only | Yes (SHA-256) |
| Agent API key hints | Yes | No (non-sensitive) |
| SQL templates | Yes | No |
| Query results | No (not persisted) | N/A |
| User emails and names | Yes | No |
| Audit log entries | Yes | No |
Query results are streamed directly to the calling AI client and are not stored by Datatape. They exist only for the duration of the request.
What Datatape does not store
- Raw agent API keys (only the SHA-256 hash)
- Database passwords in plain text (only Fernet-encrypted)
- Query result data
- AI conversation content
