Hi @viktorhrtanek,

Managed Database data is encrypted at rest with LUKS and in transit with SSL. This means all data is unreadable outside of the cluster until sent purposefully.

When you allow inbound sources (such as Droplets, Kubernetes nodes, or external IP addresses) to the database, the inbound source is presented with decrypted data when requesting it. All of the data is still encrypted while on our network, so any man in the middle trying to snoop your information will be unable to do so.

You can check our below product documentation which can provide more details about PostgreSQL Managed database.

https://docs.digitalocean.com/products/databases/postgresql/

Regards,
Rajkishore