# Encryptor.Ecto v0.2.0 - Table of Contents

> Encrypted Ecto types for the Encryptor vault - drop-in field encryption with a two-line migration

## Pages

- [Encryptor.Ecto](readme.md)
- [Changelog](changelog.md)

- Guides
  - [What changes when you move off cloak_ecto](moving-off-cloak.md)
  - [How to migrate a host app off cloak_ecto](migrate-from-cloak.md)

## Modules

- [Encryptor.Ecto](Encryptor.Ecto.md): Encrypted Ecto types for the [Encryptor](https://github.com/riddler/encryptor)
vault - `cloak_ecto`-shaped field encryption for Ecto schemas.
- [Encryptor.Ecto.Binary](Encryptor.Ecto.Binary.md): An encrypted `:binary` field, declared the way `cloak_ecto` declares one.
- [Encryptor.Ecto.BlindIndex](Encryptor.Ecto.BlindIndex.md): Declares a keyed blind index on an encrypted field (ADR-0003 decisions 4,
3c and 6's declaration half).
- [Encryptor.Ecto.BlindIndex.Declaration](Encryptor.Ecto.BlindIndex.Declaration.md): One `blind_index/3` declaration, and the single source of truth the write
side and the read side both read (ADR-0003 decisions 4, 5 and 6's
declaration half).
- [Encryptor.Ecto.BlindIndex.Derivation](Encryptor.Ecto.BlindIndex.Derivation.md): The blind index's key derivation: ADR-0003 decisions 2 and 3a, as amended on
2026-08-27 and reworked onto the vault's salted derivation surface on
2026-08-28.
- [Encryptor.Ecto.BlindIndex.Normalizer](Encryptor.Ecto.BlindIndex.Normalizer.md): The normalizers a blind index declares, and the guarantee that applying one
is total (ADR-0003 decision 4).
- [Encryptor.Ecto.BlindIndex.Value](Encryptor.Ecto.BlindIndex.Value.md): The index value itself: ADR-0003 decision 1, over a declaration.
- [Encryptor.Ecto.Declarations](Encryptor.Ecto.Declarations.md): The declared encryption contexts a host's schemas carry, and the check that
no two of them are the same (ADR-0001 decision 4, acceptance amendment 5).
- [Encryptor.Ecto.Error](Encryptor.Ecto.Error.md): The shared shape, and the redaction rules, of the encrypted-field exception
family (ADR-0001 decision 6, acceptance amendment 2).
- [Encryptor.Ecto.Map](Encryptor.Ecto.Map.md): An encrypted map field: `Encryptor.Ecto.Binary` over a serialized map
(ADR-0001 decisions 1 and 8).
- [Encryptor.Ecto.Migration](Encryptor.Ecto.Migration.md): The compile-time DSL for a migration plan (ADR-0002 decision 2).
- [Encryptor.Ecto.Migrator](Encryptor.Ecto.Migrator.md): Rewrites the ciphertext columns a plan names, against live traffic.
- [Encryptor.Ecto.Migrator.Census](Encryptor.Ecto.Migrator.Census.md): The SQL half of verification: what a plan's tables look like, read with no
application and no key.
- [Encryptor.Ecto.Migrator.Checkpoint](Encryptor.Ecto.Migrator.Checkpoint.md): Where a pass records how far it got, and what it refuses to do about the
table it records into.
- [Encryptor.Ecto.Migrator.Keyset](Encryptor.Ecto.Migrator.Keyset.md): Keyset pagination over one schema's table, below the schema layer.
- [Encryptor.Ecto.Migrator.Pass](Encryptor.Ecto.Migrator.Pass.md): One field's pass: batches of rows, probed, rewritten, checkpointed.
- [Encryptor.Ecto.Migrator.Plan](Encryptor.Ecto.Migrator.Plan.md): What a migration plan module compiles to.
- [Encryptor.Ecto.Migrator.Report](Encryptor.Ecto.Migrator.Report.md): What a pass did: one classification count per class, per-field cursors, and
the failures it found.
- [Encryptor.Ecto.Migrator.RowTenant](Encryptor.Ecto.Migrator.RowTenant.md): The per-row tenant resolver the migrator installs in the params it builds.
- [Encryptor.Ecto.Migrator.Source](Encryptor.Ecto.Migrator.Source.md): How the migrator reads the pre-migration value of a column.
- [Encryptor.Ecto.Migrator.Source.EctoType](Encryptor.Ecto.Migrator.Source.EctoType.md): Adapts any module that can already read a column's bytes to
`Encryptor.Ecto.Migrator.Source`.
- [Encryptor.Ecto.Migrator.Source.Plaintext](Encryptor.Ecto.Migrator.Source.Plaintext.md): The source for a column that was never encrypted.
- [Encryptor.Ecto.String](Encryptor.Ecto.String.md): An encrypted text field: `Encryptor.Ecto.Binary` with a `t:String.t/0` cast
arm (ADR-0001 decision 1).
- [Encryptor.Ecto.Tenant](Encryptor.Ecto.Tenant.md): The current tenant, scoped to the calling process.
- [Encryptor.Ecto.TenantContext](Encryptor.Ecto.TenantContext.md): Resolves the tenant identifier for an encrypted field.
- [Encryptor.Ecto.TenantContext.Scope](Encryptor.Ecto.TenantContext.Scope.md): The `tenant: :scope` strategy, as an ordinary `Encryptor.Ecto.TenantContext`.
- [Encryptor.Ecto.TenantScope](Encryptor.Ecto.TenantScope.md): Scopes an ExUnit case, or one `describe` block, to a tenant.

- Exceptions
  - [Encryptor.Ecto.BlindIndex.DerivationError](Encryptor.Ecto.BlindIndex.DerivationError.md): Raised when a blind index's key cannot be derived (ADR-0003's exception
table, the "key derivation fails upstream" row).
  - [Encryptor.Ecto.BlindIndex.NormalizationError](Encryptor.Ecto.BlindIndex.NormalizationError.md): Raised when a field's declared normalizer could not produce a normalized
value (ADR-0003's exception table, the "a host normalizer raises or returns
a non-binary" row).
  - [Encryptor.Ecto.DecryptError](Encryptor.Ecto.DecryptError.md): Raised when stored bytes fail to decrypt (ADR-0001 decision 6), whether
because the vault rejected them or because they are not a well-formed
message at all.
  - [Encryptor.Ecto.EncryptError](Encryptor.Ecto.EncryptError.md): Raised when the vault returns an error encrypting a value (ADR-0001
decision 6).
  - [Encryptor.Ecto.MissingContextError](Encryptor.Ecto.MissingContextError.md): Raised when the vault reports that required encryption-context keys were not
supplied (ADR-0001 decision 6, acceptance amendment 2).
  - [Encryptor.Ecto.MissingTenantError](Encryptor.Ecto.MissingTenantError.md): Raised when a field declared `tenant: :scope` is dumped or loaded with no
tenant in the process scope (ADR-0001 decision 6).
  - [Encryptor.Ecto.SerializationError](Encryptor.Ecto.SerializationError.md): Raised when the serializer behind `Encryptor.Ecto.Map` fails on a value
(ADR-0001 decision 6).
  - [Encryptor.Ecto.VaultProfileError](Encryptor.Ecto.VaultProfileError.md): Raised when a field declared `tenant: :none` names a `:tenant`-profile vault
(ADR-0001 decision 5e, acceptance amendment 3).

## Mix Tasks

- [mix encryptor.ecto.gen.migration](Mix.Tasks.Encryptor.Ecto.Gen.Migration.md): Generates the Ecto migration that creates the migrator's checkpoint table.
- [mix encryptor.ecto.gen.plan](Mix.Tasks.Encryptor.Ecto.Gen.Plan.md): Generates a `Encryptor.Ecto.Migration` plan skeleton from the host's schemas.
- [mix encryptor.ecto.migrate](Mix.Tasks.Encryptor.Ecto.Migrate.md): Runs a migration plan, in exactly one of the two modes.
- [mix encryptor.ecto.verify](Mix.Tasks.Encryptor.Ecto.Verify.md): Classifies a plan's rows without writing anything.

