> ## Documentation Index
> Fetch the complete documentation index at: https://docs.medera.info/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption

> AES-256 at rest, TLS 1.3 in transit.

| Layer                  | Algorithm | Key management                                                                           |                                                                                                                                                 |
| :--------------------- | :-------- | :--------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| PHI columns at rest    | AES-256   | Per-tenant Data Encryption Key (DEK), wrapped by Key Encryption Key (KEK) in managed KMS |                                                                                                                                                 |
| Backups at rest        | AES-256   | Customer-managed KEK option (BYOK)                                                       |                                                                                                                                                 |
| Object storage at rest | AES-256   | Customer-managed key option                                                              |                                                                                                                                                 |
| In transit             | TLS 1.3   | HTTPS enforced                                                                           |                                                                                                                                                 |
| WebSocket              | TLS 1.3   | WSS enforced                                                                             | PHI fields (SSN, insurance policy number, address, phone, email) are encrypted at the column level. Phone and email are also hashed for search. |

## Encrypted fields (Patient model)

```text theme={"system"}
patients ├─ ssn ENCRYPTED (AES-256) ├─ insurance_policy_number ENCRYPTED ├─ address ENCRYPTED ├─ phone ENCRYPTED + HASHED for search └─ email ENCRYPTED + HASHED for search
```

## Key rotation

* **DEK rotation**: quarterly, transparent re-encryption
* **KEK rotation**: annual
* **Customer-managed keys (CMK)** option for the KEK layer (enterprise plans) See [Key Management](/compliance/key-management) for the rotation procedure. ---

## What's next

<CardGroup cols={2}>
  <Card title="Key Management" icon="https://mintcdn.com/medera-357fd587/iC-6rAuwl-0aQSw_/icons/ui/key.svg?fit=max&auto=format&n=iC-6rAuwl-0aQSw_&q=85&s=4ef54e51baa6c73498065cb90a8834ff" href="/compliance/key-management" width="40" height="40" data-path="icons/ui/key.svg">
    DEK + KEK + BYOK.
  </Card>

  <Card title="Audit Logging" icon="https://mintcdn.com/medera-357fd587/iC-6rAuwl-0aQSw_/icons/ui/scroll.svg?fit=max&auto=format&n=iC-6rAuwl-0aQSw_&q=85&s=b8ef766290bd197b23cb6510210f423b" href="/compliance/audit-logging" width="40" height="40" data-path="icons/ui/scroll.svg">
    WORM + Merkle integrity.
  </Card>

  <Card title="PHI Handling" icon="https://mintcdn.com/medera-357fd587/iC-6rAuwl-0aQSw_/icons/ui/lock.svg?fit=max&auto=format&n=iC-6rAuwl-0aQSw_&q=85&s=c9887b4194639a1779d01352d3348ef2" href="/compliance/phi-handling" width="40" height="40" data-path="icons/ui/lock.svg">
    PHI flow through the platform.
  </Card>

  <Card title="Row-Level Security" icon="https://mintcdn.com/medera-357fd587/n1mgcc3nR2sq_PoL/icons/ui/table.svg?fit=max&auto=format&n=n1mgcc3nR2sq_PoL&q=85&s=c550c53e73c0531f38ae395054559211" href="/compliance/row-level-security" width="40" height="40" data-path="icons/ui/table.svg">
    Tenant isolation.
  </Card>
</CardGroup>