Encryption at rest - NetlyDB documentation

Enterprise

What is encrypted

With encryption at rest enabled, NetlyDB encrypts the data it persists - snapshots and the write-ahead log - with AES-256-GCM. Existing plaintext files remain readable, so encryption can be turned on for an existing store; data is encrypted as it is rewritten.

builder.Services.AddNetlyDB(options =>
{
    options.Security.Encryption.Enabled = true;

    // A key ring supports rotation: new writes use PrimaryKeyId, every key in the ring can still decrypt.
    options.Security.Encryption.Keys =
    [
        new NetlyDBEncryptionKey { Id = "2026-09", KeyBase64 = secrets["netlydb-key-2026-09"] },
        new NetlyDBEncryptionKey { Id = "2026-03", KeyBase64 = secrets["netlydb-key-2026-03"] }
    ];
    options.Security.Encryption.PrimaryKeyId = "2026-09";
});

Compression, when enabled, runs before encryption. The key ring lets older keys keep decrypting while new writes use the primary key.

Keys and rotation

A single 256-bit key can be supplied as KeyBase64. Source it from a secret store, never from source code.
For rotation, use a key ring: every key in Keys can decrypt data written under its id, and new writes use PrimaryKeyId. Keep an old key in the ring until the data written under it has been rewritten.
With compression enabled, data is compressed before it is encrypted.

What encryption at rest does not cover

Exports are plaintext JSON by design.
Data in memory, and data sent between cluster nodes, is decrypted; protect replication traffic with cluster TLS.