What is Encryption At Rest?
Also called Data At Rest Encryption.
Encryption at rest is the practice of storing data in encrypted form on disks, databases, object storage and backups so that the raw media cannot be read without the corresponding keys. It is a baseline control in nearly every security framework, and it defends primarily against theft of storage, misplaced backups and improperly decommissioned hardware.
Implementations sit at different layers. Full disk or volume encryption protects entire devices and is usually transparent to applications. Database level encryption protects data files and often backups. Field or column level encryption protects specific sensitive values inside otherwise readable records, and application level encryption keeps data encrypted until it reaches code that holds the key, which offers the narrowest exposure.
The important limitation is what it does not stop. An application with legitimate database access reads plaintext, so encryption at rest offers no protection against stolen application credentials, injection flaws, over broad internal access or a compromised process. Treating it as general purpose protection is a common misreading, and audits often find it cited where access control was the real control needed.
Key handling determines whether the control is meaningful. Keys stored beside the data they protect provide little benefit, so keys normally live in a dedicated management service or hardware module with separate authorization. Envelope encryption, where a data key encrypts the data and a master key encrypts the data key, makes rotation practical without rewriting entire datasets.
For AI systems the scope should include everything derived from user content, not just the primary database. Vector stores, cached retrieval results, uploaded files, conversation transcripts, evaluation datasets and log archives all carry the same sensitivity as their source, and are frequently the components where encryption coverage is found to be incomplete.
Key points
- Protects stored media, backups and decommissioned hardware
- Does not protect against compromised applications or credentials
- Volume, database, column and application layers offer different scopes
- Keys must be managed separately from the data
- Cover vector stores, caches, uploads and log archives too
In practice
A platform enables volume encryption on database and object storage, then adds column level encryption for stored access tokens so those values stay unreadable even to engineers with database access. Keys come from a managed key service using envelope encryption, allowing quarterly rotation without re-encrypting whole tables. Nightly backups inherit the same protection, and restoring one requires an explicit key grant that is recorded.