# Backup Encryption at Rest

GameCloud backups are stored in S3-compatible object storage. Production deployments should enable:

1. **Bucket SSE** — Server-side encryption (AES-256) on the backup bucket
2. **Application envelope encryption** (roadmap) — Per-backup data keys wrapped with `ENCRYPTION_KEY`
3. **Key rotation** — Documented in `docs/security/secrets.md`

Current MVP stores backups without client-side encryption. Enable bucket policies before production.