As of connector version 2026.3.0, the SAP HANA connector supports SAP HANA database encryption using Secure Store in the File System (SSFS) and Local Secure Store (LSS).

Prerequisites

When you use the SAP HANA connector with encrypted SAP HANA databases, the connector needs access to the backup of the root keys. The following prerequisites show how to create an encrypted database:

  • Set the password for the encryption root key backup. Run the command below on the source tenant database:

    alter system SET ENCRYPTION ROOT KEYS BACKUP PASSWORD {password};

  • Create the backup of the encryption root keys for the source tenant database with command below:

    For SSFS-based encryption:
hdbnsutil -backupRootKeys {name_of_backup_file}.rkb --dbid={database_id} --type='BACKUP,LOG'

For LSS-based encryption:
hdbnsutil -backupRootKeysAndSettings {backup_file} --database_name={tenant}

LSS-specific prerequisites

  • For LSS-with-encryption configurations, place the root key backup file (.rkb) on the staging host and record the file path for the Encryption Parameters section.

  • If you are working with LSS-based databases with encryption off, enter the LSS Root Key Backup Password value while creating the datasets. However, for LSS-based databases with encryption on, enter all the values in the Encryption Parameters.

Connector version requirements

The minimum connector version required to support LSS-based encrypted SAP HANA databases is 2026.3.0.

Although this is the minimum requirement, it is strongly recommended to use the latest available connector version to ensure compatibility with the latest SAP HANA revisions and connector improvements.

Encryption requirements and limitations

To ensure proper operation with encrypted SAP HANA databases, encryption must be enabled consistently across the entire SAP HANA instance. This means that instance encryption must be enabled on the source, staging, and target instances.

Partial or mixed encryption configurations across environments are not supported.

Encryption scope requirements

Encryption must be enabled at all of the following levels:

  • Backup encryption

  • Persistence (data volume) encryption

  • Log encryption

Required global.ini configuration

The following section must be present in the SAP HANA instance global.ini file:

[database_initial_encryption] 
backup_encryption = on 
persistence_encryption = on 
log_encryption = on

Why this is required

This configuration ensures that:

Tenant databases automatically inherit encryption settings from the system database. This is a requirement outside of Delphix.

If this section is not present:

Delphix operations such as dSource and VDB creation will be completed successfully. No explicit failures will occur. However, the underlying tenant databases are created without encryption enabled feature.

Last updated
Oct 9, 2026