What is Encryption at Rest?

TL;DR: Encryption at rest is the encryption of data while it is stored on disk, as opposed to encryption in transit (during transmission). It protects data from unauthorized access if physical storage media is compromised. AES-256 is the industry standard algorithm.

Encryption at Rest for SaaS Applications

Encryption at rest is a baseline security requirement for any SaaS application handling sensitive data. It ensures that even if an attacker gains access to the underlying storage infrastructure, the data remains unreadable without the encryption keys.

Encryption Algorithms

AlgorithmKey SizeUse Case

|-----------|----------|----------|

AES-256-GCM256-bitIndustry standard, authenticated encryption
ChaCha20-Poly1305256-bitMobile/embedded, software-optimized

AES-256-GCM (Galois/Counter Mode) is preferred because it provides both confidentiality and authenticity in a single operation.

Field-Level vs. Volume-Level Encryption

Field-level encryption is stronger because even database administrators cannot read the encrypted fields.

How Trailbase Encrypts Data

Trailbase uses AES-256-GCM field-level encryption for sensitive audit log fields. Encryption keys are managed separately from data storage. This means even if the database is compromised, sensitive event metadata remains encrypted and unreadable.

Related Terms

Hash Chain— A hash chain is a cryptographic data structure where each entry contains the hash of the previous en...Data Residency— Data residency refers to the physical or geographic location where data is stored and processed. Man...SOC 2— SOC 2 (Service Organization Control 2) is an auditing framework developed by the AICPA that evaluate...HIPAA— HIPAA (Health Insurance Portability and Accountability Act) is a US federal law that sets standards ...

Implement Encryption at Rest with Trailbase

Deploy enterprise-grade audit logging and compliance automation in five minutes.

Get Early AccessRead the Docs