GitHub

ArcherDB Data Protection Guide

ArcherDB uses an infrastructure-managed protection model: platform-enforced encryption at rest is the supported control for production deployments.

Scope

The archerdb start path has no data-file encryption flags. Earlier builds parsed --encryption-enabled/--encryption-key-* without wiring them into the storage path; those flags were removed so an operator cannot believe at-rest encryption is active when it is not.

What does exist, as tooling rather than a server-side at-rest control:

An encrypted-file format library (AES-256-GCM/Aegis-256, per-file DEKs wrapped by a KEK, file/AWS KMS/Vault key-provider interfaces) in src/encryption.zig, exercised by unit and integration tests
archerdb verify --encryption, which detects the ARCE encrypted-file header and verifies headers/DEK unwrap/GCM tags on files that carry it

Not provided:

Server-side encryption of live data files
Key lifecycle orchestration (rotation schedules, escrow, revocation workflows)

Use external controls as the load-bearing at-rest protection.

Recommended Controls

1) Encrypt Storage Volumes

Use the native encryption mechanism of your environment:

Cloud block volumes with provider-managed keys (KMS-backed)
LUKS/FileVault/BitLocker for self-managed hosts
Encrypted object storage for snapshots/archives

2) Centralize Key Management

Manage keys in dedicated key systems:

Cloud KMS
HSM-backed key services
Vault-based key governance

3) Enforce Access Controls

Restrict node and storage IAM roles
Separate key administrators from DB operators
Audit all key access and policy changes

4) Verify Encryption Continuously

Validate encrypted volume settings in IaC/CI
Alert on unencrypted volumes and buckets
Run periodic restore drills from encrypted snapshots

Example Verification Checklist

Data volumes are encrypted by policy
Snapshot/object storage encryption is enforced
KMS key policies follow least privilege
Key access logs are centralized and retained
Restore drills include encrypted snapshot recovery

Migration Note

If you previously passed --encryption-enabled or --encryption-key-* to archerdb start (experimental builds), remove them: they were never wired into the storage path and the server now rejects them as unknown flags. Encryption-at-rest is a platform requirement around ArcherDB.

Edit this page