Skip to content

Glossary drawing · Security & identity

Encryption at Rest

Also called: Data-at-rest encryption · At-rest encryption · Storage encryption

Note 1 —Encrypting data where it is stored, such as databases, media files and backups, so a stolen disk, snapshot or dump is unreadable without the keys.

Term
Encryption at Rest
Abbreviation
—
Category
Security & identity
Level
Foundation
Reviewed
Sheet no.
GLO-SEC-204
Drawn by
InfiQ Glossary

Drawing 1 · Interactive

Follow a record onto disk and back

5 / 5

Stage 5 of 5 · Use

The reader gets plain text. Encryption at rest protects the stored copy, not data an app is using.

At Pharmacist dashboard:Order 4471 · Rx photo · deliver to Navrangpura · +91 98XXX XX210

Order servicesees

Order 4471 · Rx photo · deliver to Navrangpura · +91 98XXX XX210
Can read itWorks with it in memory

Databasesees

Ciphertext, unreadable without the key

Cannot read itHolds only ciphertext

Pharmacist dashboardsees

Order 4471 · Rx photo · deliver to Navrangpura · +91 98XXX XX210
Can read itReads the decrypted record

Can read the message

  • The order service, which holds a KMS decrypt grant
  • The pharmacist dashboard, after an authorised read
  • Anyone who compromises those services while they run

Cannot read it

  • Someone holding a stolen disk or snapshot
  • A vendor with a copy of the backup
  • Cloud operators without permission on the key
An order record is encrypted with a data key before it is written, sits on disk and in backups as ciphertext, and is decrypted only on an authorised read. Type your own record to see what each stage holds.

Step 5 of 5, Use: The reader gets plain text. Encryption at rest protects the stored copy, not data an app is using.

What is encryption at rest?

Encryption at rest means data is encrypted while it sits in storage (database files, object storage buckets, disk volumes, snapshots and backups) and is decrypted only when an authorised process reads it. For a WhatsApp or CPaaS stack that covers conversation history, downloaded media, contact lists and opt-in records, exported CSV files, analytics copies and the backups of all of them.

The standard building block is AES with 256-bit keys, usually in an authenticated mode such as AES-GCM that also detects tampering. Rather than one key for everything, systems use envelope encryption: each file, table or volume is encrypted with its own data key, and the data keys are themselves encrypted (wrapped) by a master key held in a key management service or hardware security module. Key Management decides who may unwrap data keys, so access to the key service, not to the disk, becomes the real control.

It can be applied at several layers: full-disk or volume encryption by the cloud provider, transparent database encryption, default encryption on media buckets, and application-level (field-level) encryption for the most sensitive columns, such as phone numbers. The lower layers protect against lost hardware and leaked snapshots; only application-level encryption also protects against someone who can query the database. It is different from TLS (Transport Layer Security), which protects data in transit between machines, and from PII Masking, which limits what people see while the data is in use.

Key takeaways

  • Encryption at rest scrambles stored data so disks, snapshots, backups and dumps are unreadable without the key.
  • Most systems use AES-256 with keys held in a key management service, usually through envelope encryption.
  • It does not protect data an app is using: a compromised service or person with key access still reads plain text.
  • TLS protects data moving between machines and encryption at rest protects the stored copy; you need both.
  • Meta says Cloud API messages at rest are encrypted; your own databases, media buckets and exports are your job.

Operating sequence

How does encryption at rest work?

  1. Inventory where data lands

    List every place WhatsApp data is stored: message database, media bucket, analytics warehouse, log store, CSV exports, backups. Each needs encryption, not just the primary database.

  2. Turn on storage encryption everywhere

    Enable volume, database and bucket encryption with AES-256 by default (most clouds offer it with negligible overhead) and block the creation of unencrypted resources by policy.

  3. Hold keys in a KMS with tight access

    Keep master keys in a key management service or HSM, grant decrypt rights only to the services that need them, and log every key use.

  4. Encrypt the most sensitive fields in the app

    For phone numbers, addresses or ID numbers, add field-level encryption so someone reading the database without key access sees only ciphertext.

  5. Rotate keys and test restores

    Rotate master keys on a schedule (envelope encryption makes this cheap) and rehearse restoring encrypted backups, because a lost key means lost data.

Specifications

Encryption at rest: key facts and limits

Standard cipher
AES-256, typically in GCM mode
Key pattern
Envelope: data keys wrapped by a KMS master key
Protects against
Stolen disks, leaked snapshots, backups and dumps
Does not protect against
A compromised app or user with key access
Cloud API storage (Meta)
Messages encrypted at rest, kept up to 30 days
AES-GCM nonce
12 bytes, never reused under the same key

Failure modes

Common mistakes with encryption at rest

  • Thinking disk encryption stops a database breach

    Volume encryption is transparent to anyone who can query the database. Against SQL injection or stolen database credentials, only field-level encryption and tight access control help.

  • Forgetting exports and backups

    The primary database is encrypted while nightly CSV exports sit in an unencrypted bucket. Apply encryption by policy to every storage location, including analytics and logs.

  • Leaving caches, queues and search indexes out

    Message bodies also land in Redis caches, job queues, search indexes and webhook dead-letter stores. Teams encrypt the database and forget these; check each one has storage encryption on, or keep message text out of it.

  • Ticking the box with a provider-owned key

    Default provider-managed encryption satisfies a checklist but gives you no say over who can decrypt. For sensitive data, use a customer-managed key whose policy and logs you control (see Key Management).

  • No plan for key loss

    Deleting or losing a master key makes the data unrecoverable. Protect keys against deletion, keep recovery procedures and test restores.

Implementation

Encryption at rest in code

import crypto from "node:crypto";
 
// dataKey: a 32-byte key from your KMS (e.g. a GenerateDataKey call); store only its wrapped form.
export function encryptField(plaintext, dataKey) {
  const iv = crypto.randomBytes(12);                        // fresh for every encryption
  const cipher = crypto.createCipheriv("aes-256-gcm", dataKey, iv);
  const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
  const tag = cipher.getAuthTag();                          // detects tampering
  return Buffer.concat([iv, tag, ct]).toString("base64");   // store this in the column
}
 
export function decryptField(stored, dataKey) {
  const buf = Buffer.from(stored, "base64");
  const iv = buf.subarray(0, 12);
  const tag = buf.subarray(12, 28);
  const decipher = crypto.createDecipheriv("aes-256-gcm", dataKey, iv);
  decipher.setAuthTag(tag);
  return Buffer.concat([decipher.update(buf.subarray(28)), decipher.final()]).toString("utf8");
}

Envelope pattern: the column holds ciphertext, the row (or table) holds a wrapped data key, and only the KMS can unwrap it.

Design intent

Why does encryption at rest matter?

Many leaks come not from live systems but from copies: a misconfigured storage bucket of media files, a database snapshot shared with a vendor, a backup drive, an engineer's laptop with an export. Encryption at rest makes those copies worthless without the keys. It is also expected by customers and frameworks: ISO/IEC 27001 controls, security questionnaires, data residency reviews and the reasonable security safeguards the DPDP Act requires of data fiduciaries.

Example: A backup that leaked nothing readable

An Ahmedabad pharmacy chain archives WhatsApp prescription photos and order chats for its compliance team. Media goes to an object storage bucket with default KMS encryption, the message database runs on encrypted volumes, and patient phone numbers are field-encrypted by the application. When a vendor is accidentally given read access to a nightly backup, the copy holds only ciphertext and wrapped data keys, and the vendor's role has no decrypt permission on the key service. The chain revokes the access, records the event and confirms from the key service's logs that no decrypt call was ever made with the vendor's identity.

Recommended practice

Best practices for encryption at rest

  • Turn on default encryption at the account level so new buckets and volumes are encrypted automatically.
  • Use separate keys per environment and per data class (messages, media, exports).
  • Alert on unusual KMS decrypt volumes: a spike can be the first sign of data being pulled out.
  • Combine it with PII masking so agents and logs see fewer raw phone numbers in the first place.

Encryption at Rest FAQs

What is the difference between encryption at rest and encryption in transit?+
Encryption at rest protects stored data; encryption in transit protects data moving across a network. TLS covers the journey between machines, while at-rest encryption covers disks, buckets and backups. A secure system needs both.
Is AES-256 encryption at rest enough to protect customer data?+
It is necessary but not sufficient. It defeats stolen disks and leaked backups, but anyone who can use the running application or holds key access still sees plain text, so access control and masking matter too.
Are WhatsApp Cloud API messages encrypted at rest?+
Yes, according to Meta. Its documentation says Cloud API messages at rest are encrypted and kept for up to 30 days; copies in your provider's and your own systems need their own encryption.
Does encryption at rest satisfy the DPDP Act?+
It is one of the reasonable security safeguards the DPDP Act expects, not full compliance. Consent, purpose limits, retention, access control and breach handling are separate duties.

See InfiQ pricing

Put Encryption at Rest to work

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms