Glossary · Security

Encryption at Rest

The encryption of stored data on disk to protect it from unauthorized physical or logical access.

Encryption at rest protects stored data by encrypting it on the storage medium (disk, SSD, cloud storage). Even if physical media is stolen or unauthorized access to storage is gained, the data remains unreadable without the encryption keys. Database encryption at rest can be implemented at various levels: full-disk encryption (transparent to the database), tablespace encryption (encrypts entire tablespaces), column-level encryption (encrypts specific sensitive columns), and application-level encryption (the application encrypts data before storing it). Key management is critical–encryption keys must be stored separately from the encrypted data, rotated regularly, and backed up securely. Most cloud databases (AWS RDS, Azure SQL, Google Cloud SQL) offer encryption at rest by default.

Fig — every answer ships with the tables, rows and SQL behind it.