Skip to main content

​
Overview

Reelevant supports PGP (Pretty Good Privacy) decryption for file-based data sources. If your data provider delivers encrypted files, you can configure your datasource with a PGP private key so that files are decrypted transparently during import — no manual decryption step required. PGP decryption is available on the following source types:
PGP decryption works with both armored (.asc) and binary (.pgp, .gpg) encrypted files. The format is detected automatically.

​
Configuration

To enable PGP decryption, add the following fields in your source configuration:
These fields are treated as sensitive — they are encrypted at rest and never exposed in API responses or logs.

​
How It Works

  1. Reelevant fetches the encrypted file from the configured source (URL, FTP, S3, etc.).
  2. The file is streamed through the PGP decryption layer — the entire file is never buffered in memory.
  3. The decrypted stream is then decompressed (if .gz or .zip) and parsed as usual.
  4. Fields are extracted and made available for mapping.
Decryption only runs when pgpPrivateKey is configured. If no key is provided, the file is processed normally without any decryption overhead.

​
Supported Encryption Formats

Both formats are detected automatically — no additional configuration is needed.

​
Combining with Compression

PGP decryption is applied before decompression. This means you can have files that are both encrypted and compressed:

​
Rotate the private key

To replace the private key of a Datasource that is already configured, send the new pgpPrivateKey (and pgpPassphrase, or null if the new key has none) with the source secret rotation request. It replaces the key directly, without reconfiguring the source.
  • Send the complete armored private key, from -----BEGIN PGP PRIVATE KEY BLOCK----- to -----END PGP PRIVATE KEY BLOCK----- (see Generating a PGP Key Pair), with its line breaks written as \n.
  • Reelevant checks that the key can be read and unlocked with the passphrase before saving it. An invalid key or a wrong passphrase returns 400, and nothing is saved.
  • The new key applies to the live version, the draft and any version awaiting verification. It is used by the next import.

​
Error Handling

If decryption fails, the datasource job reports a clear error. Common failure scenarios:

​
Generating a PGP Key Pair

If your data provider needs a public key to encrypt files for you, you can generate a key pair using GPG:
Keep your private key secure. Never share it with anyone. Only the public key should be sent to your data provider.

​
Limitations

  • Single key only — each source configuration supports one private key. If files are encrypted to multiple recipients, provide the matching private key.
  • Decryption only — Reelevant decrypts incoming files but does not encrypt outgoing data.
  • File Upload source — PGP decryption is not supported for files uploaded directly via the platform UI. Use URL, FTP/SFTP, S3, or GCS for encrypted files instead.