# Encryption & Key Management

Canonical URL: https://babadook.tech/modules/encryption-key-management
Entity: modules
Content hash: 247dbacf4683af35feff8661dae9d6fdd7192a1b02cf3e45d6237251a102bd3a

End-to-end encryption with AES-256-GCM at rest, TLS 1.3 in transit, field-level PII encryption, and support for customer-managed encryption keys (CMEK).

End-to-end encryption with AES-256-GCM at rest, TLS 1.3 in transit, field-level PII encryption, and support for customer-managed encryption keys (CMEK).

## encryption-at-every-layer

Encryption at Every Layer Encryption & Key Management provides defense-in-depth across all DXP data. AES-256-GCM encryption at rest protects stored data. TLS 1.3 encrypts all data in transit. Field-level encryption applies additional encryption to PII fields — so even database access doesn't expose sensitive data. Customer-managed encryption keys (CMEK) give enterprise customers full control over their encryption keys via AWS KMS, Google Cloud KMS, or Azure Key Vault. DXP never stores or has access to plaintext customer keys.

### data Viz

## Encryption Specifications

- **At Rest:** AES-256-GCM with automatic key rotation
- **In Transit:** TLS 1.3 with perfect forward secrecy
- **Field Level:** Per-field encryption for PII with separate keys
- **CMEK:** AWS KMS, Google Cloud KMS, Azure Key Vault
- **FIPS:** FIPS 140-2 validated cryptographic modules

## features

cmek: true

tls 13: true

aes 256: true

field level: true

## Relationships

### products

- DXP — https://babadook.tech/products/dxp

### capabilities

- Enterprise Security — https://babadook.tech/capabilities/enterprise-security

### sub modules

- Security & Compliance — https://babadook.tech/sub-modules/security-compliance