A computer-implemented method comprising: providing a database (106, 503) comprising a table having columns, wherein each column comprises an encryption of a plaintext according to an encryption scheme; wherein each encryption scheme comprises at least two different encryption layers, and wherein each encryption layer is used for a specific purpose in a database query, wherein the plaintext is a central layer and wherein each encryption layer encrypts the result of the previous layer with a specific encryption type; causing an engine (104, 504) to: receive a first input comprising a database query including an expression; parse the database query and map the parsed expression using a mapping table in order to identify suitable encryption layers for each expression; update the database (106, 503), wherein updating the database comprises: - outputting of one or more encrypted database queries to be executed on the identified suitable encryption layers; - outputting a set of database queries used to update the database (106, 503) such that the respective encryption schemes are on the identified suitable encryption layers; - sending the set of database queries to the database (106, 503) for execution; execute the encrypted database queries on the updated database to produce encrypted query results; decrypt the encrypted query results at a client; and display the decrypted query results to a user; the method being characterized in that mapping the parsed expression further comprises: building a graph of columns used in the database query; for each graph node, selecting, from the mapping table, a maximum encrypted layer that can fulfill the database query; selecting, from the mapping table, a minimum encrypted layer necessary for each connected component; choosing a remaining encryption most efficient for database operation; and scanning an operator tree of the database query from leaves to root, wherein the database (106, 503) is on a server, and upon encountering a conflict an upper part of the operator tree is executed on the client. providing a database (106, 503) comprising a table having columns, wherein each column comprises an encryption of a plaintext according to an encryption scheme; wherein each encryption scheme comprises at least two different encryption layers, and wherein each encryption layer is used for a specific purpose in a database query, wherein the plaintext is a central layer and wherein each encryption layer encrypts the result of the previous layer with a specific encryption type; causing an engine (104, 504) to: receive a first input comprising a database query including an expression; parse the database query and map the parsed expression using a mapping table in order to identify suitable encryption layers for each expression; update the database (106, 503), wherein updating the database comprises: - outputting of one or more encrypted database queries to be executed on the identified suitable encryption layers; - outputting a set of database queries used to update the database (106, 503) such that the respective encryption schemes are on the identified suitable encryption layers; - sending the set of database queries to the database (106, 503) for execution; execute the encrypted database queries on the updated database to produce encrypted query results; decrypt the encrypted query results at a client; and display the decrypted query results to a user; receive a first input comprising a database query including an expression; parse the database query and map the parsed expression using a mapping table in order to identify suitable encryption layers for each expression; update the database (106, 503), wherein updating the database comprises: - outputting of one or more encrypted database queries to be executed on the identified suitable encryption layers; - outputting a set of database queries used to update the database (106, 503) such that the respective encryption schemes are on the identified suitable encryption layers; - sending the set of database queries to the database (106, 503) for execution; - outputting of one or more encrypted database queries to be executed on the identified suitable encryption layers; - outputting a set of database queries used to update the database (106, 503) such that the respective encryption schemes are on the identified suitable encryption layers; - sending the set of database queries to the database (106, 503) for execution; execute the encrypted database queries on the updated database to produce encrypted query results; decrypt the encrypted query results at a client; and display the decrypted query results to a user; building a graph of columns used in the database query; for each graph node, selecting, from the mapping table, a maximum encrypted layer that can fulfill the database query; selecting, from the mapping table, a minimum encrypted layer necessary for each connected component; choosing a remaining encryption most efficient for database operation; and scanning an operator tree of the database query from leaves to root, wherein the database (106, 503) is on a server, and upon encountering a conflict an upper part of the operator tree is executed on the client.