Others search because they can read. VaultDB searches what it cannot read.
The so-what.
A conventional database searches everything because it holds everything in plaintext — and so does anyone with database access, a backup, or the disk. Field-level encryption fixes that and kills search. VaultDB does neither: it keeps a blind index of two-byte buckets over the first four normalized characters of each indexed value, finds candidates by bucket, opens them, and lets the real field decide. Prefix search over ciphertext, an index that holds no values, and exact match and uniqueness riding the same mechanism.
Search everything. So can everyone with access to the database, the backup, or the disk. Full-disk or TDE encryption changes nothing for them.
The database cannot read the values. Neither can search: no prefix, no lookup, no uniqueness — unless you leak a deterministic fingerprint per value.
Two bytes per indexed value, ~26 four-character prefixes per bucket. Prefix search, exact match and uniqueness — without a value ever being in the index.
Live: your browser is computing the same HMAC-SHA256 buckets frozen in the engine's conformance vectors — “john doe” → 8426, “Acme, LLC” → c76c. Left-anchored only, ≥ 4 characters (the anti-enumeration floor), one keyed namespace per store. Secrets are never declared as indexed fields.
65,536 buckets. Your query is one of them.
About 26 four-character prefixes share every bucket, so a file holder cannot build an equality graph — and the engine still finds “Acme, LLC”, “ACME Inc” and “Acme Corp” from acme. Type a query: its bucket lights up in red; occupied buckets are dots.
Exact match rides the same index.
Equal values share a prefix, so they share a bucket — exact search is the same lookup with an equality filter. One at-rest contract, two filter modes.
Uniqueness is dossier-scoped.
“Unique” means unique within a tenant's tree, checked in the write transaction by candidate-open. A value's existence in another tenant is never an oracle.
Typed and compound indexes for ordered lookups.
Where a product needs range or key-ordered queries — billing periods, ledgers — a per-type indexes declaration builds named compound keys queried through the same access-checked path.
Normalize once, the same on write and query.
Fold ł ø ß æ œ, decompose, strip marks, lowercase, keep letters and digits. “Łukasz García” and “lukasz garcia” are the same four characters.