---
title: "Edge Encryption Support"
canonical: "https://docs.perspectium.com/space/Iodine/1704967/Edge%20Encryption%20Support"
format: markdown
---
<span style="color: #172b4d">The DataSync Agent can be configured to decrypt ServiceNow records with data encrypted using </span>[Edge Encryption](https://www.servicenow.com/products/edge-encryption.html)<span style="color: #172b4d">. Perspectium provides support for records encrypted using the </span>**AES-128**<span style="color: #172b4d"> and </span>**AES-256**<span style="color: #172b4d"> options.</span>


The DataSync Agent provides a **plugin** to support decrypting data that is edge encrypted. In order to decrypt this, you will need the following:

1. Edge Encryption enabled in your ServiceNow instance
2. Edge Encryption [proxy server](https://docs.servicenow.com/bundle/paris-servicenow-platform/page/administer/edge-encryption/concept/c_InstallEdgeEncryptionProxy.html) installed and configured
3. [Keystore](https://docs.servicenow.com/bundle/paris-servicenow-platform/page/administer/edge-encryption/task/configure-128-key.html)<span style="color: #172b4d"> containing the encryption key used for</span><span style="color: #172b4d"> </span>**Edge Encryption**<span style="color: #172b4d">. This keystore can be stored in an</span><span style="color: #172b4d"> </span>[Azure Key Vault](https://azure.microsoft.com/en-us/services/key-vault/)<span style="color: #172b4d"> </span><span style="color: #172b4d">cloud key management or stored locally on a filesystem the Agent as access to. </span>

With this information available, add the following configuration directives to your task definition within your **agent.xml** file:

> Macro (ui-text-box)
> 
> All attributes are required to access the keystore from the Azure Key Vault.

For Azure Key Vault, add the following:

| **Directive** | **Parameters** | **Required?** | **Example Value** |
| --- | --- | --- | --- |
| <plugin> | Plugin that will decrypt Edge Encrypted replicated data.<br>> Macro (nested-table)<br><span style="color: #172b4d">*See </span>[Authentication in Azure Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/general/authentication)<span style="color: #172b4d"> for more information on these configurations.</span><br><span style="color: #172b4d">^See </span>[<span style="color: #172b4d">Edge Encryption properties</span>](https://docs.servicenow.com/bundle/quebec-platform-administration/page/administer/edge-encryption/reference/edge-encryption-proxy-server-properties.html)<span style="color: #172b4d"> for more information on these configurations.</span><br>```
<config>
	<agent>
		<subscribe>
			<task> 
				...
				<plugin keystore="azure"
                 vault_tenant="VAULT_TENANT_GOES_HERE" 
                 vault_url="VAULT_URL_GOES_HERE"
                 vault_principal="VAULT_PRINCIPAL_GOES_HERE" 
                 principal_secret="PRINCIPAL_SECRET_GOES_HERE" 
                 secret_name="SECRET_NAME_GOES_HERE"
                 keystore_password="KEYSTORE_PASSWORD_GOES_HERE" 
                 keystore_alias="KEYSTORE_ALIAS_GOES_HERE" 
  				 alias_password="ALIAS_PASSWORD_GOES_HERE">com.perspectium.replicator.sql.plugin.SQLSubscriberDecryptColumnPlugin</plugin>

			</task>
		</subscribe>
	</agent>
</config>
``` | Yes | See example below. |

<details>
<summary>Click here to see example of a complete agent.xml configuration with the keystore in an Azure Key Vault......</summary>

```xml
<?xml version="1.0" encoding="ISO-8859-1" ?>
<config>
    <agent>
        <max_reads_per_connect>1</max_reads_per_connect>
        <polling_interval>5</polling_interval>
        <test_mode/>
        <subscribe>
            <task>
                <polling_interval>5</polling_interval>
                <task_name>oracle_subscriber_automated_test</task_name>
                <handler>com.perspectium.replicator.sql.SQLSubscriber</handler>
                <decryption_key>some_decryption_key_here</decryption_key>
                <message_connection user="USER" password="PASSWORD" queue="psp.out.replicator.dev1234">https://URL.perspectium.net</message_connection>
                <use_cache/>
                <instance_connection user="USER" password="PASSWORD">https://dev1234.service-now.com</instance_connection>
                <database_type>sqlserver</database_type>
                <database_port>1234</database_port>
                <database_server>SERVER_URL</database_server>
                <database_user>USER</database_user>
                <database_password>PASSWORD</database_password>
                <database_parms>lockTimeout=15000;queryTimeout=15</database_parms>
                <database>DATABASE_NAME</database>
                <skip_columns_log_interval>200</skip_columns_log_interval>
				<plugins>
					<plugin keystore="azure"
                            vault_tenant="12345678-ab12-ab12-ab12-123456789ab"
                            vault_url="https://url.vault.azure.net/"
                            vault_principal="12345678-ab12-ab12-ab12-123456789ab"
                            principal_secret="3213156165-adasdasd_a1s5d6a5s1d6a"
                            secret_name="some_secret_name"
							keystore_password="efg123"
                            keystore_alias="128bitkey"
                            alias_password="abc123">com.perspectium.replicator.sql.plugin.SQLSubscriberDecryptColumnPlugin</plugin>
        </task>
    </subscribe>
</agent>
</config>
```
</details>

If the keystore containing the encryption key is saved locally in the filesystem that the Agent has access to, add the following:

| **Directive** | **Description** | **Required?** | **Example Value** |
| --- | --- | --- | --- |
| <plugin> | Plugin that will decrypt Edge Encrypted replicated data.<br>> Macro (nested-table)<br>^See [Edge Encryption properties](https://docs.servicenow.com/bundle/quebec-platform-administration/page/administer/edge-encryption/reference/edge-encryption-proxy-server-properties.html) for more information on these configurations.<br>```
<config>
	<agent>
		<subscribe>
			<task> 
				...
				<plugin keystore="local"
                keystore_path="KEYSTORE_PATH_GOES_HERE"
                keystore_password="KEYSTORE_PASSWORD_GOES_HERE" 
                keystore_alias="KEYSTORE_ALIAS_GOES_HERE"
 				alias_password="ALIAS_PASSWORD_GOES_HERE">com.perspectium.replicator.sql.plugin.SQLSubscriberDecryptColumnPlugin</plugin>
			</task>
		</subscribe>
	</agent>
</config>
``` | Yes | See example below. |

<details>
<summary>Click here to see example of a complete agent.xml configuration with the keystore in a local filesystem the Agent has access to..</summary>

```xml
<?xml version="1.0" encoding="ISO-8859-1" ?>
<config>
    <agent>
        <max_reads_per_connect>1</max_reads_per_connect>
        <polling_interval>5</polling_interval>
        <test_mode/>
        <subscribe>
            <task>
                <polling_interval>5</polling_interval>
                <task_name>oracle_subscriber_automated_test</task_name>
                <handler>com.perspectium.replicator.sql.SQLSubscriber</handler>
                <decryption_key>some_decryption_key_here</decryption_key>
                <message_connection user="USER" password="PASSWORD" queue="psp.out.replicator.dev1234">https://URL.perspectium.net</message_connection>
                <use_cache/>
                <instance_connection user="USER" password="PASSWORD">https://dev1234.service-now.com</instance_connection>
                <database_type>sqlserver</database_type>
                <database_port>1234</database_port>
                <database_server>SERVER_URL</database_server>
                <database_user>USER</database_user>
                <database_password>PASSWORD</database_password>
                <database_parms>lockTimeout=15000;queryTimeout=15</database_parms>
                <database>DATABASE_NAME</database>
                <skip_columns_log_interval>200</skip_columns_log_interval>
				<plugins>
					<plugin keystore="local"
                		keystore_path="abcdefg"
               			keystore_password="efg123"
                        keystore_alias="128bitkey"
 						alias_password="abc123">com.perspectium.replicator.sql.plugin.SQLSubscriberDecryptColumnPlugin</plugin>
        </task>
    </subscribe>
</agent>
</config>
```
</details>

If you want to use attachment handling with edge encryption so the attachments are each saved as a complete file, see [Merging Attachments in the Database](https://docs-perspectium.atlassian.net/wiki/display/latest/Merging+Attachments+in+the+Database).