Abstract: In an embodiment, persistent storage contains one or more cryptographic keys. One or more processors may be configured to perform operations comprising: receiving a request for an encrypted record stored within a computational instance, wherein the request includes a plaintext value related to the encrypted record; obtaining a hash value by applying a hash function to the plaintext value; transmitting, to the computational instance, the hash value; receiving, from the computational instance, the encrypted record, wherein the encrypted record includes one or more encrypted values; obtaining an unencrypted version of the encrypted record by applying a cryptographic function to the encrypted record, wherein applying the cryptographic function includes use of a cryptographic key of the one or more cryptographic keys; and transmitting at least part of the unencrypted version of the encrypted record.