How is my data encrypted at rest?
- Topic
- Security & compliance
- Asked by
- Security teams
Atlas uses envelope encryption with per-instance keys. Each instance has its own data-encryption keys, and every sensitive value — password verifiers, OAuth/social provider client secrets, session and refresh tokens, and other credentials — is encrypted with them before it is stored.
The practical consequences:
A leak of the database alone does not expose secrets, because they are ciphertext at rest.
Keys are scoped per instance, so one instance's keys can never decrypt another's data.
Key rotation and re-encryption are supported as maintenance operations.
This posture is identical on every plan and in self-hosted deployments — encryption is the substrate, not a feature tier. More in the security overview.
Every secret — password verifiers, provider credentials, session tokens — is wrapped with per-instance envelope keys and encrypted at rest, so it is never readable in plaintext at the storage layer.