Encryption at Rest

Encryption at rest is the practice of storing data (database rows, files, logs, vectors) in encrypted form on disk — so a stolen disk or backup can't be read without the key.

Encryption at rest is table stakes for SOC 2, HIPAA, and GDPR. Modern cloud providers offer it on by default for managed databases and object storage. The interesting questions are key management (who holds the keys — vendor, customer, or KMS-managed) and field-level vs. volume-level encryption (more granular = more protection against insider misuse).

Example

A vector store holding embeddings of customer support tickets is encrypted at rest with AWS KMS keys scoped per customer. A leaked snapshot is unreadable without KMS access.

How OpenLabor uses it

OpenLabor encrypts all customer data at rest with KMS-managed keys and offers customer-managed keys on enterprise plans.

Is encryption at rest enough?

It's necessary, not sufficient. You also need encryption in transit, access controls, and audit logging.

Related: hipaa, soc-2, gdpr, audit-trail.

AI Labor Glossary