cyphera-flink

Format-preserving encryption for Apache Flink — Flink SQL UDF powered by Cyphera.

Built on io.cyphera:cyphera from Maven Central.

Build

mvn package -DskipTests

Install / Deploy

Copy the fat JAR to your Flink SQL plugin directory. See the platform documentation for details.

Usage

Protect sensitive fields in streaming analytics using Cyphera format-preserving encryption. Tag-based access means no policy name is needed to decrypt — the tag embedded in the protected value identifies the policy.

Policy File

{
  "policies": {
    "ssn": { "engine": "ff1", "key_ref": "demo-key", "tag": "T01" },
    "credit_card": { "engine": "ff1", "key_ref": "demo-key", "tag": "T02" }
  },
  "keys": {
    "demo-key": { "material": "2B7E151628AED2A6ABF7158809CF4F3C" }
  }
}

Future

• Demo environment with Docker
• Platform-specific documentation and examples
• Integration testing

License

Apache 2.0 — Copyright 2026 Horizon Digital Engineering LLC