EaaS-direct (VaultTransitFieldEncryptor) makes one Vault round-trip per field because IFieldEncryptor is per-value. For rows with several EaaS columns this multiplies latency. VaultSharp supports batched encrypt/decrypt (BatchedEncryptionItems / BatchedDecryptionItems); using it needs a higher-level seam in the generated materializer/insert path to collect a row's encrypted columns and call Vault once. The per-field contract makes this non-trivial — worth a design discussion before implementation.
EaaS-direct (
VaultTransitFieldEncryptor) makes one Vault round-trip per field becauseIFieldEncryptoris per-value. For rows with several EaaS columns this multiplies latency. VaultSharp supports batched encrypt/decrypt (BatchedEncryptionItems/BatchedDecryptionItems); using it needs a higher-level seam in the generated materializer/insert path to collect a row's encrypted columns and call Vault once. The per-field contract makes this non-trivial — worth a design discussion before implementation.