← InfrastructureSecurity

Encryption at Rest

All persistent data in BasicStack is encrypted at rest using industry-standard AES-256 encryption, protecting data on disk and in backups.

Encryption Strategy

BasicStack implements comprehensive encryption at rest for all persistent data stores, ensuring that data is protected even if physical storage media is compromised.

Implementation Details

  • PostgreSQL: Encrypted using dm-crypt/LUKS on the underlying block storage volumes
  • Hetzner Cloud Volumes: Encrypted at the storage layer with AES-256
  • Backups: All backup archives are encrypted before storage using GPG encryption
  • Kubernetes Secrets: Stored encrypted in etcd using envelope encryption

Key Management

Encryption keys are managed securely:

  • Master keys are stored in Hetzner Cloud's secure key storage
  • Keys are rotated quarterly following security best practices
  • Access to encryption keys is limited to authorized operators only
  • All key access is logged and audited

Compliance

Our encryption implementation meets GDPR requirements for data protection and follows industry best practices for encryption at rest (NIST 800-53, CIS benchmarks).