10 lines
477 B
Markdown
10 lines
477 B
Markdown
# Backup Encryption at Rest
|
|
|
|
GameCloud backups are stored in S3-compatible object storage. Production deployments should enable:
|
|
|
|
1. **Bucket SSE** — Server-side encryption (AES-256) on the backup bucket
|
|
2. **Application envelope encryption** (roadmap) — Per-backup data keys wrapped with `ENCRYPTION_KEY`
|
|
3. **Key rotation** — Documented in `docs/security/secrets.md`
|
|
|
|
Current MVP stores backups without client-side encryption. Enable bucket policies before production.
|