removed PG Community mentions

removed PG community tde_heap_basic mentions and improved tde limitation and supported versions text, I kept the Release notes mentions though. Also added a note saying tde_heap_basic is deprecated
percona · Andriciuc · May 8, 2025 · Apr 17, 2025 · Apr 17, 2025 · Apr 22, 2025
commit 043b44e3f9622fb3671dde676acc454e45ef5f18
@@ -20,4 +20,4 @@ This setup is intended for development and stores the keys unencrypted in the sp
 
 ## Next Step
 
-[Test pg_tde :material-arrow-right:](../test.md){.md-button}
+[Test pg_tde :material-arrow-right:](../test.md){.md-button}
@@ -4,19 +4,19 @@
 
 If you encrypted a table with the `tde_heap` access method and need to remove the encryption from it, run the following command against the desired table (`mytable` in the example below):
 
-```
+```sql
 ALTER TABLE mytable SET ACCESS METHOD heap;
 ```
 
 Note that the `SET ACCESS METHOD` command drops hint bits and this may affect performance. Running a plain `SELECT count(*)` or `VACUUM` command on the entire table will check every tuple for visibility and set its hint bits. Therefore, after executing the `ALTER TABLE` command, run a simple `count(*)` on your tables:
 
-```
+```sql
 SELECT count(*) FROM mytable;
 ```
 
 Check that the table is not encrypted:
 
-```
+```sql
 SELECT pg_tde_is_encrypted('mytable');
 ```
 
@@ -26,7 +26,7 @@ The output returns `f` meaning that the table is no longer encrypted.
 
 Alternatively, you can create a new not encrypted table with the same structure and data as the initial table. For example, the original encrypted table is `EncryptedCustomers`. Use the following command to create a new table `Customers`:
 
-```
+```sql
 CREATE TABLE Customers AS
 SELECT * FROM EncryptedCustomers;
 ```
@@ -35,6 +35,6 @@ The new table `Customers` inherits the structure and the data from `EncryptedCus
 
 (Optional) If you no longer need the `EncryptedCustomers` table, you can delete it.
 
-```
+```sql
 DROP TABLE EncryptedCustomers;
 ```
@@ -2,8 +2,8 @@
 
 To encrypt the data, two types of keys are used:
 
-* Internal encryption keys to encrypt user data. They are stored internally, near the data that they encrypt.
-* The principal key to encrypt database keys. It is kept separately from the database keys and is managed externally in the key management store.
+* **Internal encryption keys** to encrypt user data. They are stored internally, near the data that they encrypt.
+* The **principal key** to encrypt database keys. It is kept separately from the database keys and is managed externally in the key management store.
 
 !!! note
     For more information on managing and storing principal keys externally, see [Configure Global Key Provider](../global-key-provider-configuration/index)

@@ -1,14 +1,22 @@
 # How does TDE help?
 
-TDE enables you to encrypt data at rest. It provides the following benefits:
+## Benefits for organizations
 
-- For organizations:
-  * Ensure data safety when it is stored on disk and in backups
-  * Comply with security and legal standards like HIPAA, PCI DSS, SOC 2, ISO 27001
+* Data safety: Prevents unauthorized access to stored data, even if backup files or storage devices are stolen or leaked.
+* Supports regulatory alignment: Implements encryption-at-rest, a common requirement in standards such as HIPAA, PCI DSS, and ISO/IEC 27001.
 
-- For DBAs:
-  * Granular encryption of specific tables and reducing the performance overhead that encryption brings
-  * Additional layer of security to existing security measures like storage-level encryption, data encryption in transit using TLS, access control and more.
+## Benefits for DBAs and engineers
+
+* Granular control: Encrypt specific tables or databases instead of the entire system, reducing performance overhead.
+* Operational simplicity: Works transparently without requiring major application changes.
+* Defense in depth: Adds another layer of protection to existing controls like TLS (encryption in transit), access control, and role-based permissions.
+
+When combined with external Key Management Systems (KMS), TDE enables centralized control, auditing, and rotation of encryption keys—critical for secure production environments.
+
+!!! note "Compliance Disclaimer"
+    Percona TDE includes encryption features that align with common security best practices.  
+    However, using TDE alone does not guarantee compliance with any specific regulatory standard (e.g., HIPAA, PCI DSS, SOC 2, or ISO/IEC 27001).  
+    Organizations are responsible for evaluating the overall security posture and ensuring that all necessary controls and validations are in place to meet regulatory requirements.
 
 !!! admonition "See also"
 

@@ -1,5 +1,7 @@
 # What is Transparent Data Encryption (TDE)?
 
-Transparent Data Encryption is a technology to protect data at rest. The encryption process happens transparently in the background, without affecting database operations. Data is automatically encrypted as it's written to the disk and decrypted as it's read, all in real-time. Users and applications interact with the data as usual without noticing any difference.
+Transparent Data Encryption (TDE) protects your data at rest by ensuring that even if the underlying storage is compromised, the data remains unreadable without the correct encryption keys. This is especially critical for environments handling sensitive, regulated, or high-value information.
+
+Encryption happens transparently in the background, with minimal impact on database operations.
 
 [How does TDE help?](how-tde-helps.md){.md-button} [Check the full feature list](../features.md){.md-button} [Get started](../install.md){.md-button}
@@ -1,17 +1,21 @@
 # Versions and supported PostgreSQL deployments
 
-The `pg_tde` extension comes in two distinct versions with specific access methods to encrypt the data. These versions are database-specific and differ in terms of what they encrypt and with what access method. Each version is characterized by the database it supports, the access method it provides, and the scope of encryption it offers.
+The `pg_tde` extension is available for [Percona Server for PostgreSQL 17.x](https://docs.percona.com/postgresql/17/postgresql-server.html), an open source, drop-in replacement for PostgreSQL Community. This version provides the `tde_heap` access method and offers [full encryption capabilities](../features.md), including encryption of tables, indexes, WAL data, and support for logical replication.
 
-* **Version for Percona Server for PostgreSQL**
+The extension is tightly integrated with Percona Server for PostgreSQL to deliver enhanced encryption functionality that is not available in community builds.
 
-    This `pg_tde` version is based on and supported for [Percona Server for PostgreSQL 17.x :octicons-link-external-16:](https://docs.percona.com/postgresql/17/postgresql-server.html) - an open source binary drop-in replacement for PostgreSQL Community. It provides the `tde_heap` access method and offers [full encryption capabilities](../features.md).
+## Why choose Percona Server for PostgreSQL?
 
-* **Community version** (deprecated)
+By using our PostgreSQL distribution, you get:
 
-    This version is available with PostgreSQL Community 16 and 17, and Percona Distribution for PostgreSQL 16. It provides the `tde_heap_basic` access method, offering limited encryption features. The limitations are in encrypting WAL data only for tables created using the extension and no support of index encryption nor logical replication.
+- **Full encryption support** through the `tde_heap` access method, including tables, indexes, WAL data, and logical replication.
+- **Enhanced performance and enterprise-ready features** not available in community builds.
+- **Regular updates and security patches** backed by Percona’s expert support team.
+- **Professional support** and guidance for secure PostgreSQL deployments.
 
-## Which version to choose?
+!!! note
+    Support for earlier or limited versions of `pg_tde` (such as `tde_heap_basic`) has been deprecated.
 
-Enjoy full encryption with the Percona Server for PostgreSQL version and the `tde_heap` access method. The Community version is deprecated and is planned to be removed in future releases.
+Still unsure which deployment fits your needs? [Contact our experts](https://www.percona.com/about/contact) to find the best solution for your environment.
 
-Still not sure? [Contact our experts](https://www.percona.com/about/contact) to find the best solution for you.
+[Get Started: Install pg_tde :material-arrow-right:](../install.md){.md-button}
@@ -79,11 +79,13 @@ Here is how you can set the new default table access method:
         You can run the SET command anytime during the session. 
 
         ```sql
-        SET default_table_access_method = tde_heap;
+            SET default_table_access_method = tde_heap;
         ```
 
 2. Reload the configuration to apply the changes:
 
     ```sql
-    SELECT pg_reload_conf();
+        SELECT pg_reload_conf();
     ```
+
+[Limitations of TDE](tde-limitations.md){.md-button}
@@ -1,11 +1,11 @@
 # What does TDE encrypt?
 
-`pg_tde` encrypts the following:
+`pg_tde` encrypts the following components:
 
-* User data in tables, including TOAST tables, that are created using the extension. The metadata of those tables is not encrypted.
-* Temporary tables created during the database operation for data tables created using the extension
-* Write-Ahead Log (WAL) data for the entire database cluster. This includes WAL data in encrypted and non-encrypted tables
-* Indexes on encrypted tables
-* Logical replication on encrypted tables
+* **User data** in tables using the extension, including associated TOAST data. The table metadata (column names, data types, etc.) is not encrypted.
+* **Temporary tables** created during the query execution, for data tables created using the extension.
+* **Write-Ahead Log (WAL) data** for the entire database cluster. This includes WAL data in encrypted and non-encrypted tables.
+* **Indexes** associated encrypted tables.
+* **Logical replication data** for encrypted tables (ensures encrypted content is preserved across replicas).
 
 [How TDE uses table access methods?](table-access-method.md){.md-button}
@@ -1,7 +1,9 @@
-# Known limitations
+# Limitations of TDE
 
 * Keys in the local keyfile are stored unencrypted. For better security we recommend using the Key management storage.
 * System tables are currently not encrypted. This means that statistics data and database metadata are currently not encrypted.
 
 * `pg_rewind` doesn't work with encrypted WAL for now. We plan to fix it in future releases.
 * `pb_tde` Release candidate is incompatible with `pg_tde`Beta2 due to significant changes in code. There is no direct upgrade flow from one version to another. You must [uninstall](../how-to/uninstall.md) `pg_tde` Beta2 first and then [install](../install.md) and configure the new Release Candidate version.
+
+[Versions and supported PostgreSQL deployments](table-access-method.md){.md-button}
@@ -7,7 +7,7 @@ Enabling `pg_tde` extension for a database creates the table access method `tde_
 1. Create a table in the database for which you have [enabled `pg_tde`](setup.md) using the `tde_heap` access method as follows:
 
     ```sql
-    CREATE TABLE <table_name> (<field> <datatype>) USING tde_heap;
+        CREATE TABLE <table_name> (<field> <datatype>) USING tde_heap;
     ```
 
     <i warning>:material-information: Warning:</i> Example for testing purposes only:
@@ -26,7 +26,7 @@ Enabling `pg_tde` extension for a database creates the table access method `tde_
 2. To check if the data is encrypted, run the following function:
 
     ```sql
-    SELECT pg_tde_is_encrypted('table_name');
+        SELECT pg_tde_is_encrypted('table_name');
     ```
 
     The function returns `t` if the table is encrypted and `f` - if not.
@@ -40,14 +40,14 @@ You can encrypt an existing table. It requires rewriting the table, so for large
 Run the following command:
 
 ```sql
-ALTER TABLE table_name SET ACCESS METHOD tde_heap;
+    ALTER TABLE table_name SET ACCESS METHOD tde_heap;
 ```
 
 Note that the `SET ACCESS METHOD` command drops hint bits and this may affect the performance. Running a plain `SELECT count(*)` or `VACUUM` commands on the entire table will check every tuple for visibility and set its hint bits. Therefore, after executing the `ALTER TABLE` command, run a simple `count(*)` on your tables:
 
 ```sql
-SELECT count(*) FROM table_name;
+    SELECT count(*) FROM table_name;
 ```
 
 !!! hint
-    If you no longer wish to use `pg_tde` or wish to switch to using the `tde_heap_basic` access method, see how you can [decrypt your data](how-to/decrypt.md).
+    If you no longer wish to use `pg_tde` or wish to switch the access method, see how you can [decrypt your data](how-to/decrypt.md).
@@ -154,18 +154,18 @@ extra:
             feedback form</a>.
 
 nav:
-  - Home: index.md
-  - Overview:
-    - "Transparent Data Encryption (TDE)":
+  - "Home": index.md
+  - "Features": features.md 
+  - "Overview":
+    - "What is Transparent Data Encryption (TDE)?":
       - "Introduction": index/index.md
       - "How does TDE help?": index/how-tde-helps.md
       - "How does TDE work?": index/how-does-tde-work.md
       - "What does TDE encrypt?": index/tde-encrypts.md
       - "Table access methods and TDE": index/table-access-method.md
     - "Limitations of TDE": index/tde-limitations.md
     - "Versions and supported deployments": index/supported-versions.md
-  - features.md 
-  - Get started:
+  - "Get started":
     - "1. Install pg_tde": install.md
     - "1.1 Via apt": apt.md
     - "1.2 Via yum": yum.md   
@@ -180,14 +180,14 @@ nav:
   - functions.md
   - command-line-tools.md
   - variables.md
-  - Architecture: architecture/index.md
-  - How to:
+  - "Architecture": architecture/index.md
+  - "How to":
     - "Uninstall pg_tde": how-to/uninstall.md
     - "Configure multi-tenancy": how-to/multi-tenant-setup.md
     - "Use reference to external parameters": how-to/external-parameters.md
     - "Decrypt an encrypted table": how-to/decrypt.md
   - faq.md
-  - Release notes:
+  - "Release notes":
     - "pg_tde release notes": release-notes/release-notes.md
     - release-notes/rc.md
     - release-notes/beta2.md