> For the complete documentation index, see [llms.txt](https://learn.capstorm.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.capstorm.com/cs-govern/best-practices/securing-a-csguardian-database.md).

# Securing a CS:Govern Database

![](https://869259762-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyE2QoOSmKpot88Q3kHGR%2Fuploads%2Fgit-blob-3236c0be7548c6fa1a53dd74f8584140f5e6ccbb%2F5fcf6d03-Govern-Banner.png?alt=media)

## How to Secure A CS:Govern Database

**This article is about securing your CopyStorm data at the field level using CS:Govern, as well as recommendations on securing the target CopyStorm database. Fundamentally, the basic essential steps are the following:**

1. **Manage access to the Database. This is an action taken by the Database Administrator.**
2. **Manage access to specific fields within a table through users and roles. These are actions taken by the CopyStorm/CS:Govern user.**
3. **Remove all access to the Encryption Keys. This is an action taken by the Database Administrator.**

**It is suggested that the customer use their own Security Standards and Knowledge to append and/or replace the basic Security Architectural Design offered in this article.**

Securing a CS:Govern database is the process of ensuring that only database users granted rights by CS:Govern can access decrypted values of fields.

For any user to be able to access decrypted data (where they have CS:Govern rights), execute access to a single function (per table with encrypted data) is required.

* To access decrypted data in table “Contact” a user will need execute rights on the function *guardContact\_GET*().
* By default, CS:Govern grants public execute rights to all generated \_GET functions and hides others.
* Each \_GET function enforces access policies set up by CS:Govern .
* If a user accesses an encrypted field WITHOUT using the corresponding \_GET function, they will always get the masked value for the field.

As an example of how to use the \_GET function (sometimes referred to as the *getter*) here is how one would include the Contact.Email field in a typical SQL SELECT statement (in this example we are using SQL Server):

SELECT id, guardContact\_GET(id, ‘Email’, Email) FROM Contact;