Encryption at rest Scrambling stored data so a stolen disk is unreadable.
Short answer. Encryption at rest means data written to storage, such as disks, databases and backups, is encrypted, so someone who steals the drive or a backup copy cannot read it without the key. The standard cipher is AES, which uses keys of 128, 192 or 256 bits. It protects against loss and theft. It does not protect data while the system is running with the key loaded, because the system decrypts it for authorised use. The key is the weak point: NIST warns that if a key is lost or damaged the data may be unrecoverable. India’s DPDP Rules, 2025 list encryption, obfuscation, masking and virtual tokens among the minimum security measures for personal data.
01
What it covers
NIST’s guide to storage encryption compares several layers. Which one a product uses decides what is protected.
Layer
What is encrypted
What it does not protect
Full disk
Everything on the drive that boots the computer, operating system included
A running computer with the key loaded; files copied elsewhere
Volume or virtual disk
A partition or a container file that is opened after sign-in
Data outside the container, such as swap and hibernation files
File or folder
Chosen files, readable only after the user authenticates
Everything else on the disk, and file names and metadata
Backups
The copy on tape, disk or cloud
Anything, if the key is stored beside the backup
02
Keys decide everything
Encryption turns the question “who can read the disk?” into “who can reach the key?”. NIST’s guide says that if a key is lost or damaged it may not be possible to recover the encrypted data, so key generation, use, storage, recovery and destruction should be decided before encryption is switched on.
Where the key lives matters. One common approach is to keep it in a trusted platform module (TPM) on the machine rather than in a file beside the data. Microsoft says BitLocker gives maximum protection when used with a TPM, which works with BitLocker to help ensure the device has not been tampered with while offline.
03
What it does not do
It does not protect a running system. NIST: once the computer has booted, the operating system is responsible for protecting the data.
It does not stop copies. Storage encryption products decrypt files automatically when they are copied or moved elsewhere.
It does not stop a person with a valid sign-in, or malware running as that person.
It does not replace access control, logging or backups.
04
What the Indian and EU rules say
Rule 6 of the DPDP Rules, 2025 requires a data fiduciary to take reasonable security safeguards that include, at the minimum, securing personal data through encryption, obfuscation, masking or virtual tokens, controlling access to computer resources, keeping logs, and making data backups. Rule 6 comes into force 18 months after the Rules were published in November 2025. GDPR Article 32 likewise lists pseudonymisation and encryption among the appropriate technical measures for personal data of people in the EU. This is general information, not legal advice.
05
Questions for a vendor
What is encrypted: the database, uploads, search index, logs, backups, temporary files and swap?
Which algorithm and key length are used?
Who holds the keys, and what releases them at start-up: a TPM, a passphrase or a key server?
How are keys rotated, backed up and destroyed?
What happens to the stored data when the device is repaired or retired?
06
Where ANVE stands
ANVE’s security page (/security) says everything sits in one database on the box, and that full-disk encryption is part of the appliance image, which is not on ANVE yet. Details such as the algorithm, key handling and recovery are questions to settle in writing before a paid pilot.
07
Questions people ask
Is encryption at rest the same as full-disk encryption?
Full-disk encryption is one way to do it. Others encrypt a volume, a file or folder, a database or a backup. NIST’s guide compares the first three.
Does it protect against hackers?
Only in some cases. It protects against someone who gets the disk or a backup without the key. An attacker who signs in as a user, or runs malware on the running system, sees the decrypted data.
What happens if we lose the key?
The data may be unrecoverable, according to NIST. Keep recovery keys apart from the device, in a place two people can reach, and test recovery before relying on it.
Do backups need encryption?
Yes. NIST advises that backups be secured at least as well as the original, for example by encrypting them.
08
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
