It's still not piecing together 100% for me, sorry I'm not trying to be obtuse or anything.
So maybe let me simplify my question: If I set up both a copy of a database with values encrypted by CipherStash, and an application server connected to it, and the application server has enough access to do queries on sensitive data (eg "WHERE sensitiveField = ?", pretend it needs that for a migration), and a developer has root access on the application box while it's running, and a gdb session connected to the app, can they see any sensitive data or no?
If they can't, then that's genuinely cool, and I probably need to look into the workings a bit more!
So maybe let me simplify my question: If I set up both a copy of a database with values encrypted by CipherStash, and an application server connected to it, and the application server has enough access to do queries on sensitive data (eg "WHERE sensitiveField = ?", pretend it needs that for a migration), and a developer has root access on the application box while it's running, and a gdb session connected to the app, can they see any sensitive data or no?
If they can't, then that's genuinely cool, and I probably need to look into the workings a bit more!