Encrypted Django Model Fields

Question

A client wants to ensure that I cannot read sensitive data from their site, which will still be administered by me. In practice, this means that I'll have database access, but it can't be possible for me to read the contents of certain Model Fields. Is there any way to make the data inaccessible to me, but still decrypted by the server to be browsed by the client?

Answer 1

This is possible with public key encryption. I have done something similar before in PHP but the idea is the same for a Django app:

All data on this website was stored encrypted using a private key held by the system software. The corresponding public key to decrypt the data was held by the client in a text file.

When the client wanted to access their data, they pasted the public key into an authorisation form (holding the key in the session) which unlocked the data.

When done, they deauthorised their session.

This protected the information against authorised access to the web app (so safe against weak username/passwords) and also from leaks at the database level.

This is still not completely secure: if you have root access to the machine you can capture the key as it is uploaded, or inspect the session information. For that the cure could be to run the reading software on the client's machine and access the database through an API.

I realise this is an old question but I thought I'd clarify that it is indeed possible.