Every disk, encrypted
Encrypted by default, no cost or setup. This isn't an add-on, it's how we store your data from the first moment.
How it works
Every virtual disk is natively encrypted (AES-256-GCM) from the moment it's created, with its own randomly generated 256-bit key. It's never shared or reused across disks. That key is protected by a master key that's never written to any disk: it lives only in memory while the system is running. When a VM is deleted, we destroy its key first and the disk second, so if something goes wrong partway through, there's nothing left to recover.
The master key, which lives only in memory, wraps each disk's 256-bit key (random, never shared between disks), and that key is what encrypts your disk.
What it protects
Encryption by default isn't a checkbox you tick. It's how every disk is created from the very first moment.
Physical theft
If someone walks off with a drive from the datacenter, its contents are useless without the key, and the key doesn't live on the drive.
Decommissioning
Retiring a drive at the end of its life doesn't require wiping it block by block. Destroying its key is enough to make the contents unrecoverable.
Tenant isolation
Each disk has its own independent key. Even with access to the shared storage, another customer's data stays unreadable without its specific key.
What it doesn't cover
Encryption at rest protects a disk that's powered off. While your VM is running, its data is decrypted and readable from the server running it, same as on any other platform. It's one layer, not a promise that nothing can ever be seen.
Coming soon: encryption in memory too
As we scale to more nodes, we'll add hardware-level memory encryption for running VMs: an extra layer on top of the at-rest encryption you already have today.