An Oracle database is considered TDE-enabled when both of the following criteria are met:

  • A TDE keystore is configured for the root container (and for the PDB if using isolated mode).

  • A master key is generated for the root container.

If any of the above conditions are not met, the database is considered non TDE-enabled.

Whether tablespaces are encrypted or not is not a criterion for determining if a database is TDE-enabled.
Delphix does not support Isolated keystore mode for OKV and HSM keystore types. In isolated mode, a pluggable database (PDB) has its own keystore and the keystore and its TDE master encryption keys can be managed from the PDB only. Only United keystore mode is supported.

Supported provisioning paths

Delphix supports provisioning from a TDE-enabled source database (dSource) to a TDE-enabled target database, as well as from a non TDE-enabled source database to a non TDE-enabled target database. However, Delphix does not support provisioning from a TDE-enabled source database to a non TDE-enabled target database, or vice versa.

Specifically, the table below lists the supported and unsupported provisioning paths:

Source Database Target Database Supported?
TDE-enabled TDE-enabled Y
TDE-enabled non TDE-enabled N
non TDE-enabled non TDE-enabled Y
non TDE-enabled TDE-enabled N

The table below lists the supported and unsupported provisioning path for a PDB keystore mode:

Source Database PDB Keystore Mode Target Database PDB Keystore Mode Supported
United United Y
United Isolated N
Isolated United N
Isolated Isolated Y
Last updated
Oct 9, 2026