3 min readResonate HQJust published
Payload encryption at the promise store boundary in TypeScript
How a ~50-line AES-256-GCM Encryptor keeps PII out of the promise store without touching workflow logic.
Encrypt every value Resonate stores — function arguments, return values, intermediate state — by implementing a two-method Encryptor interface. Workflow code is unchanged; the codec calls encrypt() on the way in and decrypt() on the way out.