> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy the SAP HANA service

> Step-by-step deployment of the SAP HANA Transparent Data Protection service in CryptoHub, including data-directory path rules.

Complete the following steps to deploy the SAP HANA Transparent Data Protection service in CryptoHub.

<Steps>
  <Step>
    Log in to the CryptoHub under dual control using your administrator identities.
  </Step>

  <Step>
    Select the **SAP HANA** service and select **\[ Deploy ]**.
  </Step>

  <Step>
    Configure the **Service Setup** settings:

    * **Service Name**: The name of the service. Leave as default.
    * **Service Category**: The category the service falls under. Leave as default.
    * Select **\[ Next ]**.
  </Step>

  <Step>
    Configure the **Access Control** settings:

    * **Authorized Resources**: The role you are logged in with has access to the service by default.
    * **Add Additional Resources**: Optional.
    * Select **\[ Next ]**.
  </Step>

  <Step>
    Configure the **Path Rules** that determine which files are encrypted and which identities may access them.

    * Select **\[ Add Path Rule ]**.
    * For **Users**, enter the SAP HANA administrator user (for example, `<sid>adm`).
    * For **Groups**, enter the SAP HANA group (`sapsys`).
    * For the path, use **Advanced Setup** with the `**` wildcard to recursively match every file under the protected directory.
    * Select **\[ Add ]**.
  </Step>

  <Step>
    Select **\[ Deploy ]**.
  </Step>
</Steps>

## Choose the path rule for the data directory

Protecting the SAP HANA **data directory** is the primary purpose of this integration, so add a path rule that covers it.

<Warning>
  On Linux, a TDP path rule must target the **backing directory** — the physical location where `fesfifs` stores ciphertext — not the mount that SAP HANA reads and writes through. A rule written against the mount path loads cleanly but silently matches nothing, because the kernel driver passes the backing path to the policy agent. The result is raw passthrough: files are written in the clear with no error. This guide uses a backing directory of `/enc/hana-data` for the data volume; adjust to match your deployment.
</Warning>

For a data directory whose backing store is `/enc/hana-data`, add a path rule with:

* **Path:** `/enc/hana-data/**`
* **Groups:** `sapsys`
* **Users:** `<sid>adm`

To also protect the log volumes and native backups, add path rules for their backing directories in the same way — for example `/enc/hana-log/**` and `/enc/hana-backup/**` — each scoped to the same `sapsys` group and `<sid>adm` user.

<Note>
  Note the correspondence between the mount and its backing directory. SAP HANA reads and writes through the mount (for example, `/hana/shared/data`), while the path rule and the ciphertext at rest live in the backing directory (for example, `/enc/hana-data`). You configure this pairing when you [mount the encrypted filesystem](/Integrations/CryptoHub/Database/SAP_HANA/Mount_the_encrypted_filesystem_for_SAP_HANA).
</Note>