Encryption
TLS 1.3 for data in transit and AES-256-GCM for data at rest — encryption is on by default and not optional.
Silos encrypts your data both in transit and at rest. Neither is a setting you have to turn on — they are the default and, for transport, mandatory.
In transit: TLS 1.3
Every client connection to a Silos database is encrypted with TLS 1.3. Connections that do not negotiate TLS are rejected, so your connection string must request SSL:
psql "postgres://user:password@db-xxxx.silos.sh/main?sslmode=require"The sslmode=require parameter is not optional. If your client expresses SSL as a
separate option rather than a query parameter, set it the way that client expects — for
example, PGSSLMODE=require as an environment variable, or ssl: true in a driver
config. See Connection strings for details.
The management REST API is likewise served over HTTPS. Requests to
https://api.silos.sh/v1/... are encrypted in transit.
At rest: AES-256-GCM
A database's durable state — its compressed snapshots and WAL segments — is encrypted with AES-256-GCM before it is written to object storage. AES-256-GCM is an authenticated encryption mode, so it protects both the confidentiality and the integrity of stored data.
Encryption at rest is applied automatically. You do not manage encryption keys, ciphers, or storage configuration to benefit from it.
What this means in practice
No plaintext on the wire
Client traffic and API traffic are encrypted end to end with TLS 1.3.
No plaintext at rest
Snapshots and WAL are encrypted with AES-256-GCM before they touch storage.
On by default
There is no 'enable encryption' step. Transport encryption is mandatory; at-rest encryption is automatic.
Still your responsibility
Encryption protects data on the wire and on disk. It does not protect a leaked credential. Keep connection strings and API keys out of source control, rotate them if exposed, and load them from environment variables or a secret manager — see Authentication.