Files
HexaHost-GameCloud/docs/security/backup-encryption.md

477 B

Backup Encryption at Rest

GameCloud backups are stored in S3-compatible object storage. Production deployments should enable:

  1. Bucket SSE — Server-side encryption (AES-256) on the backup bucket
  2. Application envelope encryption (roadmap) — Per-backup data keys wrapped with ENCRYPTION_KEY
  3. Key rotation — Documented in docs/security/secrets.md

Current MVP stores backups without client-side encryption. Enable bucket policies before production.