Also known as: data at rest encryption · disk encryption
Encryption at rest is the encryption of stored data — on disks, in databases, or in backups — so that physical access to the storage medium does not yield readable data.
It defends against a specific threat model: stolen hardware, improperly disposed drives, and unauthorised access to raw storage. It provides little protection against an attacker who compromises a running application, because that application holds decryption keys and reads data normally.
This distinction is frequently blurred in compliance discussions. Full-disk encryption on a running server is doing nothing against an active intrusion, even though it satisfies a checkbox.
End-to-End Encryption
End-to-end encryption (E2EE) is a system in which messages are encrypted on the sender's device and decrypted only on the recipient's, so that no intermediary — including the service provider — can read the content in transit or at rest on its servers.
Password Hashing
Password hashing is the practice of storing passwords as the output of a deliberately slow, salted one-way function, so that a breach of the credential database does not immediately yield usable plaintext passwords.
Zero-Knowledge Architecture
A zero-knowledge architecture is one in which a service provider stores user data but holds no ability to decrypt it, because encryption and key management happen entirely on the user's device.
Data Minimization
Data minimisation is the principle that an organisation should collect and retain only the personal data actually necessary for a stated purpose, and no more, for no longer than needed.