Ship faster with centralized encryption that keeps your sensitive data private.#
Shipping new capabilities and AI agents quickly shouldn’t mean compromising the privacy of your application data. As you build, sensitive information—such as customer email addresses or payment details—can flow to third-party managed services. Encrypting that data before it reaches those services keeps the protected values unreadable to the services receiving them. But missed or misconfigured encryption can leave it exposed, and maintaining consistent protection across applications takes time away from building your product.
That's why Temporal’s security model gives you control over your code and sensitive data. Your application code and Workers run on compute you control. SDK Data Converters in your Clients and Workers can encrypt application inputs and results, called Workflow payloads, before they reach Temporal Cloud.
Temporal Proxy builds on that foundation by centralizing Workflow payload encryption in a component you run in your environment, using keys you control. Teams can share this protection without implementing, distributing, and updating custom encryption libraries across applications. Developers spend less time maintaining encryption code, platform teams
Temporal Proxy is available in Public Preview, fully supported and recommended for production environments.
Where protection happens and what stays yours.#
The diagram below shows where Workflow payload encryption happens and what Temporal Cloud receives. In the deployment shown, your Workers—the processes that run your application code—connect out through the proxy. Temporal Cloud does not need inbound access to your business systems.
Your applications send inputs such as customer email addresses or payment details to Temporal Proxy over an authenticated mTLS connection. Temporal Proxy encrypts those values, called payloads, before forwarding them to Temporal Cloud, which stores ciphertext alongside execution metadata.
Your keys control whether those payloads can be read. Temporal Proxy supports AWS KMS, Google Cloud KMS, Azure Key Vault, and custom key-management backends. It uses envelope encryption: a short-lived data key encrypts the payload using AES-256-GCM. Your key-management service protects that data key using a key you control, which remains in the service. The protected data key travels with the encrypted payload.
When a Worker needs the value, Temporal Proxy uses your key-management service to recover the data key and decrypt the payload. It returns the readable value to the Worker within your environment. Temporal Cloud stores the encrypted payload and protected data key but cannot decipher them.
How to make protection consistent#
To apply Temporal Proxy’s payload encryption consistently across your applications and Workers, make the proxy their required connection to Temporal Cloud. Keep Temporal Cloud credentials with the proxy, and use network restrictions to block direct connections from applications and Workers to Temporal Cloud. With these controls in place, applications and Workers cannot accidentally bypass the proxy’s encryption.
This matters because encryption can be missed or misconfigured even when an application otherwise works correctly. Our Trust and Compliance team has repeatedly helped customers who unintentionally sent sensitive data to Temporal Cloud without encryption. Requiring the shared connection reduces dependence on each developer and code reviewer catching those mistakes.
Security reviewers can examine the proxy’s configuration and access restrictions as a shared control, rather than checking separate encryption integrations across application codebases. Temporal Proxy users have passed strict security reviews because they had this control in place.
Configure encryption for application payloads, and enable protection for error messages and stack traces. Search Attributes, the searchable metadata used to find executions, remain unencrypted. Enabling encryption does not encrypt data already stored in Temporal Cloud.
See the encryption guide for coverage and configuration details.
Get started with Temporal Proxy#
Temporal Proxy is available in Public Preview, fully supported and recommended for production. If you’re a Temporal Cloud customer, Temporal Proxy support is included in your support contract.
You deploy and operate Temporal Proxy in your environment, connect it to your key-management service, and configure your applications and Workers to use it. Follow the Temporal Proxy documentation to get started with deployment, access controls, and encryption.
As you add applications and agents, your teams can use a shared encryption mechanism to keep sensitive application data private from Temporal Cloud. That means less encryption integration and maintenance to repeat, and more time to ship new capabilities.