{"head":{"title":"What Is Encryption at Rest? Definition and Example","description":"Encryption at rest protects stored data in databases, files and backups, so it is unreadable without the key. What it covers and common mistakes.","canonical":"https://oceanlab.in/glossary/encryption-at-rest"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"encryption at rest","path":"/glossary/encryption-at-rest"}],"slug":"encryption-at-rest","term":"Encryption at rest","aka":["data-at-rest encryption","storage encryption"],"category":"Compliance","short":"Encrypting stored data, such as databases, files and backups, so it cannot be read without the key.","body":[["Encryption at rest protects data where it sits: database storage, object storage, disks, backups and laptops. Most cloud providers can switch it on for managed storage. Some systems add field-level or application-level encryption for the most sensitive values, so even someone with database access cannot read them."],["Rules refer to it in different ways. The HIPAA Security Rule lists encryption of ",{"href":"/glossary/ephi","text":"ePHI"}," as an addressable safeguard in 45 CFR 164.312, and GDPR Article 32 names encryption as an example of an appropriate security measure. NIST SP 800-111 covers storage encryption for devices."]],"why":["If storage, a backup or a laptop is lost or copied, encryption at rest turns a data breach into lost ciphertext. It is one of the first questions in security reviews and ",{"href":"/glossary/soc-2-type-ii","text":"SOC 2"}," audits. It does not protect against someone using a valid login, which is why access control still matters."],"example":["A payroll SaaS encrypts its database and backups with keys from a managed key service, and also encrypts bank account numbers at the field level. A support engineer with database access sees employee names but not account numbers."],"inBuild":["Turning on storage encryption, setting up key management and deciding which fields need extra encryption are hosting decisions made at the start of a build, and much harder to change once data exists."],"mistakes":[["Keeping the keys next to the data, which makes the encryption decorative."],["Encrypting the database but not exports, files or backups."],["Thinking encryption at rest means data is safe from the application's own users."]],"related":[{"href":"/glossary/encryption-in-transit","label":"Encryption in transit","detail":"Encrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way."},{"href":"/glossary/tokenization","label":"Tokenization (payments)","detail":"Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service."},{"href":"/glossary/ephi","label":"ePHI (electronic protected health information)","detail":"Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects."},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II","detail":"An independent audit report on whether a service organisation's controls were designed well and worked over a period of time."}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."},{"href":"/compliance/soc-2","label":"SOC 2 guide","detail":"The controls behind a SOC 2 report."}],"sources":[{"title":"45 CFR 164.312, HIPAA technical safeguards (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312","checkedAt":"2026-10-25"},{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"},{"title":"NIST SP 800-111, Guide to Storage Encryption Technologies","url":"https://csrc.nist.gov/pubs/sp/800/111/final","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}