"We encrypt sensitive data at rest" is a sentence I've heard applied to Pega apps that encrypt nothing beyond what's on disk at the storage layer. Platform Cipher with an external KMS is real, property-level encryption you control the keys for — but only for the properties you explicitly mark. Here's what it covers, what it costs you, and what it was never going to protect.

Moving a production Postgres database off Neon to self-hosted Proxmox meant losing managed backups and PITR. Here's the architecture I replaced it with: async streaming replication to a second node that doubles as a pgBackRest repo host, with Cloudflare R2 as a decoupled offsite mirror — plus the two designs I tried and dropped first.

If you've followed this blog for a while, you'll know I mostly write about enterprise architecture, integration patterns, and the odd war story from the Pega trenches. This post is a bit different —…

Why Generative AI Is Not the Answer to Every Problem — and How to Use It Securely What Even Is Generative AI? (And Why It's Different From the AI You Already Know) Before we talk about misuse, we…

This guide documents the auth-host mode pattern using thomseddon/traefik-forward-auth:2 (TFA). It replaces the more complex oauth2-proxy approach that required a dual-router hack and an errors…