Secure file handling & encryption at rest
Files that hold client records, contracts and financial data need encryption that survives a stolen disk, a leaked bucket and a careless administrator. Our team designs storage so the data is encrypted before it is written and the keys are held and logged somewhere else.
What we do
- Envelope encryption design with per-object data keys
- AES-256-GCM with unique nonces and integrity checks
- Wrapping keys in AWS KMS, Google Cloud KMS, Azure Key Vault or OCI Vault
- Customer-managed keys on cloud object storage, including Cloudflare R2
- Client-side encryption before files leave the device
- Key rotation, revocation and re-wrap procedures
- Access policies and audit logs for every decrypt
- Tested recovery so an encrypted archive can always be restored
The pattern we use is envelope encryption: each file or object is encrypted with its own random data key using AES-256‑GCM, an authenticated mode that detects tampering, and the data key is wrapped by a key in a managed key service. We have worked with AWS Key Management Service (AWS KMS), Google Cloud Key Management Service (Cloud KMS), Azure Key Vault and Oracle Cloud Infrastructure Vault (OCI Vault) for the wrapping keys, and with Cloudflare R2, which encrypts stored objects at rest.
Encryption is only part of secure handling. We also design access control, retention, secure delivery, audit logging and tested recovery, so a key can be rotated or revoked without losing the data. This group supports Cybersecurity, Cloud Management and Tailored Software.
Platforms and practices
- Envelope encryption
- AES-256-GCM
- AWS Key Management Service (AWS KMS)
- Google Cloud Key Management Service (Cloud KMS)
- Azure Key Vault
- Oracle Cloud Infrastructure Vault (OCI Vault)
- Cloudflare R2
- Client-side encryption before upload
- Key rotation & revocation design
References
- NIST SP 800-38D: Galois/Counter Mode (GCM) and GMAC
- AWS: How AWS KMS uses envelope encryption
- Google Cloud: Cloud KMS
- Microsoft Azure: Azure Key Vault
- Oracle: OCI Vault (Key Management)
- Cloudflare Docs: R2 data security (encryption at rest)
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.