SecurityComing soon
Encrypt / Decrypt
Will encrypt a column with AES-256-GCM using a key held in FlowDoo's secret store, or decrypt it back — e.g. an SSN column before an export leaves the building.
When to use it
Use it when sensitive values must travel or rest encrypted but some later step, with the same key, needs them back. If nobody needs them back, use Hash or Mask instead.
In a pipeline
File InputEncrypt / DecryptExport CSV
Settings
| Setting | Type | Required | Default or hint |
|---|---|---|---|
| Mode | select | — | encrypt |
| Column | select | Yes | Select column… |
| Algorithm | select | — | aes-256-gcm |
| Key | select | Yes | Select a stored key… |
Example
Encrypt SSNs before export
- Mode=Encrypt
- Column=SSN
| Name | SSN |
|---|---|
| Ann | 123-45-6789 |
| Name | SSN |
|---|---|
| Ann | enc:v1:<iv>:<tag>:<ciphertext> |
Each value is self-describing — enc:v1, then the IV, the authentication tag and the ciphertext — so Decrypt needs only the key.
Worth knowing
- Coming soon: the key will live in the connection / secret store only — never in the flow, the node settings, a preview or a log. Where those keys are stored is still to be decided, so the node cannot be added to a flow yet.
- AES-256-GCM detects tampering: a value changed after encryption fails to decrypt rather than giving wrong text.