Payload Codec
This page discusses Payload Codec.
What is a Payload Codec?
A Payload Codec transforms an array of Payloads (for example, a list of Workflow arguments) into another array of Payloads.
When serializing to Payloads, the Payload Converter is applied first to convert your objects to bytes, followed by codecs that convert bytes to bytes. When deserializing from Payloads, codecs are applied first to last to reverse the effect, followed by the Payload Converter.
Use a custom Payload Codec to transform your Payloads; for example, implementing compression and/or encryption on your Workflow Execution data.
Encryption
Using end-to-end encryption in your custom Data Converter ensures that sensitive application data is secure when handled by the Temporal Server.
Apply your encryption logic in a custom Payload Codec and use it locally to encrypt data. You maintain all the encryption keys, and the Temporal Server sees only encrypted data. Refer to What is Key Management? for more guidance.
Your data exists unencrypted only on the Client and the Worker process that is executing the Workflows and Activities, on hosts that you control. For details, see Securing your data.
The following samples use encryption (AES GCM with 256-bit key) in a custom Data Converter: