Security · Data Security
Encryption
Protecting data confidentiality and integrity in transit, at rest and increasingly in use, with key management as the hard part.
IntermediateUpdated 2026-09-01
Overview
Symmetric algorithms such as AES protect bulk data; asymmetric algorithms establish trust and exchange keys. TLS protects transit, full disk and storage service encryption protect data at rest, and confidential computing addresses data in use.
Encryption is only as strong as key management. Who holds the keys, where they are stored, how they rotate, and who can decrypt are the questions that determine whether encryption provides real assurance.
Security considerations
- Use platform key management services or HSMs; never embed keys in code or configuration files.
- Understand whether provider managed or customer managed keys are required by your obligations.
- Plan for post quantum migration by inventorying where public key cryptography is used.