adk-secure-sessions 1.0.0

Encrypted session storage for Google ADK — drop-in replacement for DatabaseSessionService with at-rest encryption

adk-secure-sessions

The compliance gateway for Google ADK — add encrypted sessions in 5 minutes.

ADK's built-in session services store all data unencrypted. If your agents handle PHI, PII, or financial data, that's a compliance gap. adk-secure-sessions is a drop-in replacement for DatabaseSessionService that encrypts state and conversation history at rest, so you can close the encryption-at-rest gap without changing your agent code.

Install

pip install adk-secure-sessions

Or with uv:

uv add adk-secure-sessions

3 direct runtime dependencies: google-adk, cryptography, aiosqlite.

Quick Start

# Before (ADK default — unencrypted):
from google.adk.sessions import DatabaseSessionService
session_service = DatabaseSessionService(db_url="sqlite:///sessions.db")

# After (encrypted — swap the import and constructor):
from adk_secure_sessions import EncryptedSessionService, FernetBackend, BACKEND_FERNET
session_service = EncryptedSessionService(
    db_path="sessions.db", backend=FernetBackend("your-secret-key"), backend_id=BACKEND_FERNET
)

Use session_service exactly like any ADK session service — create_session, get_session, list_sessions, delete_session, and append_event all work the same way. Wrap in async with for automatic cleanup — see Documentation for details.

What Gets Encrypted

Data	Encrypted	Rationale
state values (user_state, app_state, session_state)	Yes	Contains sensitive user/app data
events (conversation history)	Yes	Contains user messages, tool outputs, PII
session_id, app_name, user_id	No	Needed for lookups and filtering
create_time, update_time	No	Needed for expiration/cleanup

Links

• Documentation
• Security Policy
• Contributing
• Roadmap
• License (Apache-2.0)