Glossary · entry 10 / 12
Encryption at rest
Encryption at rest means the stored data is locked so it cannot be read without the key, even by someone who takes the drive. It protects records on your machines and in backups.
"At rest" distinguishes stored data from data moving across a network. A stolen laptop, a lost backup drive, or a decommissioned server holds only unreadable ciphertext when the data on it was encrypted at rest.
The question that matters is who holds the key. When a cloud vendor encrypts your data with keys the vendor controls, the vendor can still read it. When the keys stay with your own government, only you can.
This is what makes an off-site backup safe to keep anywhere: the drive can sit in a safe-deposit box or another building you trust, and losing it loses nothing.