New in v10.1 — AES-GCM authenticated encryption, blind-index search, and worldwide PII discovery. See what's included →
Field-level encryption for .NET · EF Core 9 / 10

Encryption your database never sees the key to.

The complete data-protection layer for Entity Framework Core: transparent field encryption, ML-powered PII discovery, exfiltration detection, and audit-ready compliance evidence — for teams where control and compliance are non-negotiable.

Explore pricing Start for free
Your keys, never ours Runs air-gapped · no telemetry MIT core · offline licensing DPDP · GDPR Art. 32 ready
Pricing

One license. Everything included.

Free for small projects and evaluation. When your project earns more than $5,000 a year, a single flat license unlocks the full platform — no tiers to decode, no per-seat math, no feature gates.

Community
For small projects, OSS & evaluation
Free
under $5,000 annual revenue · MIT core
Get started
  • Field encryption — CBC & AES-GCM
  • All checksum-verified detectors
  • Auto-encryption & blind-index search
  • Custom rules & all attributes
  • Full documentation & community support
No seat limit · no expiring activation · same binaries as the paid license.
Complete platform
Enterprise License
For every project earning over $5,000 a year
$1,099 / yr
per organization · unlimited developers & applications
Get your license
  • Everything in Community, org-wide
  • ML classifier — names, addresses, free text
  • Crypto Sentinel exfiltration alarm
  • Email & HMAC-signed webhook alerts
  • Custom alert channels — SIEM, Slack, PagerDuty
  • Compliance evidence pack — JSON + A4 PDF
  • Accepted-risk exemption ledger
  • Priority support · 2 business-day SLA
Every feature included — no add-ons, no usage fees, no per-seat charges. One price covers your whole organization. Redistribution / OEM licensing available — talk to us.
Free while you're under $5,000 a year — including development, testing & personal projects.

Install from NuGet and ship your project at no cost. A license is required once the project it's used in earns more than $5,000 in annual revenue.

Get started now
Compare plans

Everything you need to protect and prove

The capabilities development and compliance teams need to encrypt PII, detect exfiltration, and pass audits — mapped across every plan.

← swipe to compare →

Capability Community
Free · under $5K/yr
 Enterprise License
$1,099/yr · unlimited
Encryption core
AES-GCM authenticated encryptionRandom nonce per value, tamper-detection tag, key-ring rotation✓✓
Auto-encryption by conventionPII columns encrypt by default; opt-out is the explicit act✓✓
Blind-index searchFast equality lookups on encrypted columns via keyed-HMAC shadow columns✓✓
Zero-migration upgrade pathExisting CBC data and APIs keep working, unchanged✓✓
PII discovery
Checksum-verified detectorsAadhaar, Luhn cards, IBAN mod-97, SSN, crypto wallets, IFSC, and more✓✓
Name heuristics & custom rules140-token vocabulary + your own tokens and regex patterns✓✓
ML classifierNames, addresses, free-text PII — extensible with your corpus—✓
Live-data sampling scanSamples real column values, not just namesNames onlyFull
Detection & alerting
Crypto SentinelML spike detection on decryption rates — the exfiltration alarm—✓
Email & webhook alertsYour SMTP; HMAC-signed webhooks; digests, retries, dead-letter—✓
Custom alert channelsSIEM, Slack, PagerDuty, and any IAlertChannel—✓
Compliance
Compliance evidence packInventory, coverage, findings, alert history — JSON + print-ready A4—✓
Accepted-risk exemption ledgerEvery deliberate plaintext decision, with sign-off—✓
Support
Support channelCommunityPriority
Response SLA—2 business days
Annual architecture review—✓
Redistribution / OEM rightsShip the library inside a product you sell—Add-on
Due diligence

Frequently asked questions

The questions your security review and procurement teams will ask — answered up front.

Who holds the encryption keys?
You, exclusively. The library has no code path that generates, stores, or transmits key material. You construct the provider with a key from your own vault (Azure Key Vault, AWS KMS, HashiCorp Vault) — without it, nothing encrypts. Blind indexes use a second, independently rotatable key, also yours.
Does anything leave our network?
Only the SMTP and webhook traffic you configure, to endpoints you own. License validation is fully offline via an ECDSA signature check — no activation server, no telemetry, no vendor cloud. It runs air-gapped.
We already use the free version — what changes?
Nothing technical. The paid license unlocks the ML classifier, Sentinel, alerting, and compliance features — same package, same APIs, same encrypted data. Once your project crosses $5,000 in annual revenue you add a license key; your code doesn't change and there is no migration, ever.
When exactly do I need a license?
The moment the project using the library earns more than $5,000 in annual revenue. Below that — plus all development, testing, and personal projects — it's free. Above it, one $1,099/year license covers your whole organization: unlimited developers, unlimited applications, no per-seat counting.
What happens when a license expires?
You get warning alerts 14 days out through the same pipeline as security alerts. On expiry, paid features stop with clear log messages and your application keeps running on Community behavior. Enterprise APIs throw a typed exception rather than emitting incomplete compliance documents.
Can we verify what the code does?
Yes — the core is MIT open source, and the companion ships readable, documented C# with ~50 unit tests including published checksum vectors (ISO IBAN, BIP-173, Luhn). Your security team can read every line that touches your data.
What does it cost in performance?
Microseconds per field. Reads sustain 50–120k rows/s end-to-end; writes stay bottlenecked on the database; queries skipping encrypted columns pay nothing; Sentinel telemetry is lock-free nanoseconds. A bundled benchmark suite reproduces it on your hardware.
Can I upgrade or change plans later?
Anytime. We issue a new license for the updated term with prorated credit for the unused portion of your existing license. Downgrades apply at renewal.
Sales Inquiries

Contact an expert

Please answer the questions below to help our team assist you more effectively.

  • Enterprise licensing, volume, and renewal questions
  • Redistribution / OEM licensing for ISVs
  • Security review, compliance, and rollout support

Our team will respond to your request within 1 business day.

Get started

Protect the next column in five minutes

Start free in your environment, or talk to us about Enterprise licensing and rollout.

$ dotnet add package EntityFrameworkCore.Crypto.DataEncryption.ML
Get your Enterprise license — $1,099/yr Read the source