# IContentProtector

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.icontentprotector/
> Summary: IContentProtector: Extension point for at-rest encryption of stored content.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Abstractions.dll</code></div>

Extension point for at-rest encryption of stored content.

```csharp
public interface IContentProtector
```

## Remarks

There is no default implementation; a consumer opts in explicitly through
`AddContentProtection`. When nothing is registered, the stores that
consume this interface fall back to a no-op implementation that writes
plaintext unchanged — today's behavior, with no surprises.

**This protects data at rest, not a running process.** A
process holding the key still sees plaintext once a value is read back;
this interface addresses a stolen backup, a discarded disk, or a
misconfigured table permission — not a compromised application server.

[IContentProtector.Unprotect](/api/tracon.icontentprotector/#Tracon_IContentProtector_Unprotect_System_String_) and [IContentProtector.UnprotectBytes](/api/tracon.icontentprotector/#Tracon_IContentProtector_UnprotectBytes_System_ReadOnlySpan_System_Byte__) are
**self-describing**: they decide whether a value is
protected by looking at the value itself, not at configuration. A value
written before protection was turned on therefore stays readable after
protection is turned on, and a value written while protection was on
stays readable after it is turned off.

## Properties

### <a id="Tracon_IContentProtector_IsEnabled"></a> IsEnabled

Gets a value indicating whether this instance is ready to protect new writes.

```csharp
bool IsEnabled { get; }
```

#### Property Value

 [bool](https://learn.microsoft.com/dotnet/api/system.boolean)

#### Remarks

A column-level decision (which columns are in scope) is layered on
top of this by the caller; this flag only says whether the
implementation itself has everything it needs (for example, a
resolved encryption key).

## Methods

### <a id="Tracon_IContentProtector_Protect_System_String_"></a> Protect\(string\)

Protects a text value before it is written to storage.

```csharp
string Protect(string plaintext)
```

#### Parameters

`plaintext` [string](https://learn.microsoft.com/dotnet/api/system.string)

The value to protect.

#### Returns

 [string](https://learn.microsoft.com/dotnet/api/system.string)

The protected representation. It must be safe to store in the same
column the plaintext would have gone into.

### <a id="Tracon_IContentProtector_ProtectBytes_System_ReadOnlySpan_System_Byte__"></a> ProtectBytes\(ReadOnlySpan<byte\>\)

Protects binary data before it is written to storage.

```csharp
byte[] ProtectBytes(ReadOnlySpan<byte> plaintext)
```

#### Parameters

`plaintext` [ReadOnlySpan](https://learn.microsoft.com/dotnet/api/system.readonlyspan\-1)<[byte](https://learn.microsoft.com/dotnet/api/system.byte)\>

The bytes to protect.

#### Returns

 [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

The protected representation. It must be safe to store in the same
column the plaintext would have gone into.

### <a id="Tracon_IContentProtector_Unprotect_System_String_"></a> Unprotect\(string\)

Reverses [IContentProtector.Protect](/api/tracon.icontentprotector/#Tracon_IContentProtector_Protect_System_String_).

```csharp
string Unprotect(string stored)
```

#### Parameters

`stored` [string](https://learn.microsoft.com/dotnet/api/system.string)

The value as read back from storage.

#### Returns

 [string](https://learn.microsoft.com/dotnet/api/system.string)

The original plaintext. When `stored` was never
protected, it is returned unchanged.

### <a id="Tracon_IContentProtector_UnprotectBytes_System_ReadOnlySpan_System_Byte__"></a> UnprotectBytes\(ReadOnlySpan<byte\>\)

Reverses [IContentProtector.ProtectBytes](/api/tracon.icontentprotector/#Tracon_IContentProtector_ProtectBytes_System_ReadOnlySpan_System_Byte__).

```csharp
byte[] UnprotectBytes(ReadOnlySpan<byte> stored)
```

#### Parameters

`stored` [ReadOnlySpan](https://learn.microsoft.com/dotnet/api/system.readonlyspan\-1)<[byte](https://learn.microsoft.com/dotnet/api/system.byte)\>

The bytes as read back from storage.

#### Returns

 [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

The original bytes. When `stored` was never
protected, it is returned unchanged.