477 B
477 B
Backup Encryption at Rest
GameCloud backups are stored in S3-compatible object storage. Production deployments should enable:
- Bucket SSE — Server-side encryption (AES-256) on the backup bucket
- Application envelope encryption (roadmap) — Per-backup data keys wrapped with
ENCRYPTION_KEY - Key rotation — Documented in
docs/security/secrets.md
Current MVP stores backups without client-side encryption. Enable bucket policies before production.