As of today, the SAP HANA Connector supports SAP HANA database encryption using Secure Store in the File System (SSFS).

Support for Local Secure Store (LSS)–based encrypted HANA databases is currently not available.

Prerequisites

While using the SAP HANA connector with encrypted SAP HANA databases, connector needs access to the backup of the root keys. The following prerequisites shows how an encrypted database can be created:

  • Set the password for the backup of the encryption root keys, Run the command below on the source tenant database:

    alter system SET ENCRYPTION ROOT KEYS BACKUP PASSWORD {password};

  • Create the backup of the encryption root keys for the source tenant database with command below:

    hdbnsutil -backupRootKeys {name_of_backup_file}.rkb --dbid={database_id} --type='BACKUP,LOG’

Connector version requirements

The minimum connector version required to support encrypted SAP HANA databases is 2025.x.x

Although, this is the minimum requirement, it is strongly recommended to always use the latest available connector version to ensure compatibility with the latest SAP HANA revisions and improvements in the connector.

Encryption requirements and limitations

To ensure proper operation with encrypted SAP HANA databases, encryption must be enabled consistently across the entire SAP HANA instance. This means that instance encryption must be enabled on source, staging, target instances.

Partial or mixed encryption configurations across environments are not supported.

Encryption scope requirements

Encryption must be enabled at all of the following levels:

  • Backup encryption

  • Persistence (data volume) encryption

  • Log encryption

Required global.ini configuration

The following section must be present in the SAP HANA instance global.ini file:

[database_initial_encryption] 
backup_encryption = on 
persistence_encryption = on 
log_encryption = on

Why this is required

This configuration ensures that:

Tenant databases automatically inherit encryption settings from the system database. This is a requirement outside of Delphix.

If this section is not present:

Delphix operations such as dSource and VDB creation will be completed successfully. No explicit failures will occur. However, the underlying tenant databases are created without encryption enabled feature.

Last updated
Oct 9, 2026