Abstract: A database system includes a persistent storage system, a memory storing metadata defining a tenant object and a plurality of database artifacts, a first instance of the tenant object, the first instance associated with a first plurality of the database artifacts including first data associated with the first instance of the tenant object, and a second instance of the tenant object, the second instance associated with a second plurality of the database artifacts including second data associated with the second instance of the tenant object. A processing unit is to execute program code of a database instance to cause the database system to encrypt the first data associated with the first instance of the tenant object using a first public encryption key and store the encrypted first data in the persistent storage system, and encrypt the second data associated with the second instance of the tenant object using a second public encryption key and store the encrypted second data in the persistent storage system.

Abstract: Various examples are directed to systems and methods using a database management system. The database management system may generate a root certificate for a database host of the database management system and a first host certificate using the root certificate. The database management system may receive, from a first client associated with the first tenant, a request to access the root certificate stored at a root certificate storage location and send the root certificate to the first client. The database management system may receive, from the first client, a request to establish a secure communication connection. The secure communication connection with the first client may be established at least in part by providing the first host certificate to the first client.

Abstract: A request is received to change a first, current encryption root key used to encrypt and decrypt a set of data in a database. A new, second encryption root key is generated. The second encryption root key is stored in a secured area in disk storage as a new current encryption root key. The first encryption root key is maintained in the secured area as a historical encryption root key. New root key version information that identifies the new, second encryption root key is generated and stored as current root key version information. A request is received to encrypt the set of data. The second encryption root key is identified as the current encryption root key based on the current root key version information. The second encryption root key is used to encrypt the set of data to create an encrypted set of data.

Abstract: A request is received to change a first, current encryption root key used to encrypt and decrypt a set of data in a database. A new, second encryption root key is generated. The second encryption root key is stored in a secured area in disk storage as a new current encryption root key. The first encryption root key is maintained in the secured area as a historical encryption root key. New root key version information that identifies the new, second encryption root key is generated and stored as current root key version information. A request is received to encrypt the set of data. The second encryption root key is identified as the current encryption root key based on the current root key version information. The second encryption root key is used to encrypt the set of data to create an encrypted set of data.