Skip to main content
The SAP HANA integration uses the CryptoHub Transparent Data Protection (TDP) service to encrypt the SAP HANA data directory — the persistent store that holds your database’s tables, columns, and savepoints — as well as its log volumes and native file backups. TDP enforces encryption through centrally managed policies and keys, so data is protected at rest on disk while remaining transparently readable to SAP HANA.

​
SAP HANA

SAP HANA is an in-memory, column-oriented relational database that serves as the data foundation for SAP S/4HANA and many enterprise analytics workloads. While HANA keeps working data in memory for performance, it persists that data to disk so the database survives restarts and can be recovered. That on-disk persistence is what TDP protects. The most important on-disk asset is the data volume, which lives under the persistence base path (for example, /hana/shared/data/<SID>). It contains:
  • Data volumes (datavolume_*.dat): The primary persisted copy of your database — tables, column stores, and the contents flushed at each savepoint.
  • Log volumes: The redo log, used to recover committed transactions after a restart or crash.
  • Native backups: Data and log backups written by BACKUP DATA and log-backup operations.
Because the data volume is the authoritative on-disk copy of your database, encrypting it is the primary goal of this integration: it ensures that anyone with access to the underlying storage — a disk image, a stolen volume, a backend filesystem — cannot read your database contents. Protecting the log volumes and backups extends that same guarantee to the rest of HANA’s persisted footprint.

​
Key features

TDP has the following features:
  • Seamless encryption: Encrypt entire directories — including the SAP HANA data directory — with strong, standards-based encryption, so your persisted database is always protected on disk.
  • Transparent operation: Encryption and decryption happen in the kernel as SAP HANA reads and writes its files, with no changes to the database itself.
  • Centralized management: Define encryption policies and manage keys from a single CryptoHub interface, and monitor which directories are protected.

​
Benefits of the integration

Integrating with CryptoHub provides the following benefits:
  • Data-at-rest protection for your database: The authoritative on-disk copy of your SAP HANA database is stored as ciphertext, so raw storage access does not expose your data.
  • Operational transparency: SAP HANA runs against the encrypted mount without application changes; the database reads and writes exactly as it would on a normal filesystem.
  • Centralized key and policy control: Encryption keys never live with the data — they are managed on CryptoHub and delivered to the agent under policy.