Encryption at rest
Also called data-at-rest encryption, storage encryption.
Encrypting stored data, such as databases, files and backups, so it cannot be read without the key.
Last updated
What it is.
Encryption at rest protects data where it sits: database storage, object storage, disks, backups and laptops. Most cloud providers can switch it on for managed storage. Some systems add field-level or application-level encryption for the most sensitive values, so even someone with database access cannot read them.
Rules refer to it in different ways. The HIPAA Security Rule lists encryption of ePHI as an addressable safeguard in 45 CFR 164.312, and GDPR Article 32 names encryption as an example of an appropriate security measure. NIST SP 800-111 covers storage encryption for devices.
Why it matters
If storage, a backup or a laptop is lost or copied, encryption at rest turns a data breach into lost ciphertext. It is one of the first questions in security reviews and SOC 2 audits. It does not protect against someone using a valid login, which is why access control still matters.
In a product build
Turning on storage encryption, setting up key management and deciding which fields need extra encryption are hosting decisions made at the start of a build, and much harder to change once data exists.
Common mistakes.
- 01
Keeping the keys next to the data, which makes the encryption decorative.
- 02
Encrypting the database but not exports, files or backups.
- 03
Thinking encryption at rest means data is safe from the application's own users.
Read the official text.
Primary sources this definition is based on.
- 45 CFR 164.312, HIPAA technical safeguards (eCFR)checked 2026-10-25
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
- NIST SP 800-111, Guide to Storage Encryption Technologieschecked 2026-10-25
Work it out with a tool.
Related terms.
- Encryption in transitEncrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way.
- Tokenization (payments)Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service.
- ePHI (electronic protected health information)Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects.
- SOC 2 Type IIAn independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
Guides and pages
Browse the full glossary or read answers to common questions.
