Encryption at Rest

Encryption at rest is the practice of encrypting data at rest — data stored on disk rather than moving across the network — so that even if a database file, backup, snapshot, or storage volume is physically stolen or improperly accessed, the contents remain unreadable without the decryption key. The companion concept is encryption in transit (TLS), which protects data while it's flowing between systems.

The standard algorithm for data at rest encryption is AES-256, a symmetric cipher that's both mathematically robust and hardware-accelerated on modern CPUs (Intel AES-NI, AWS Nitro, ARM crypto extensions). Cloud providers offer transparent data-at-rest protection at multiple layers: full-disk encryption on the underlying volume (AWS EBS, DigitalOcean Block Storage), database-engine encryption (AWS RDS, managed Postgres), and object-storage encryption (S3 with SSE-S3 or SSE-KMS). These are usually one-checkbox features that add no measurable performance overhead.

Application-level encryption goes further by encrypting specific fields — PII, credit card numbers, health records — before they reach the database, so even a privileged database admin can't read them. The trade-off is that you lose the ability to query or index the encrypted field directly; deterministic encryption or searchable encryption schemes work around this with their own trade-offs. Encryption at rest is a baseline requirement under HIPAA, PCI DSS, SOC 2, and GDPR, so for any business handling regulated data, it's not optional.