# Encryption of data at rest

**URL:** <https://forum.confluent.io/t/encryption-of-data-at-rest/37850>\
**Category:** Ops\
**Created:** [28 May 2025 21:49 UTC](https://forum.confluent.io/t/encryption-of-data-at-rest/37850 "2025-05-28T21:49:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jcurrent](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@jcurrent](https://forum.confluent.io/u/jcurrent)\
**Post date:** [28 May 2025 21:49 UTC](https://forum.confluent.io/t/encryption-of-data-at-rest/37850/1 "2025-05-28T21:49:18Z")

</div>

Hi!

I am reading a lot of encryption of data in motion with mTLS, but I am trying to figure out if Confluent server provides support for encryption of data at rest.  
Some resources indicate that this has to be done at OS-level by encrypting the disk. ([https://youtu.be/nhw6J9N6UIg?t=306](https://youtu.be/nhw6J9N6UIg?t=306))

However, some resources seem to indicate that this feature exists ([Manage security in Confluent Platform | Confluent Documentation](https://docs.confluent.io/platform/current/security/overview.html#data-protection-and-encryption))

Does Confluent Server provide this feature? or perhaps even E2E-encryption?

if not: are there any best practices regarding encryption at rest with for example LUKS?

/J

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [2 June 2025 18:20 UTC](https://forum.confluent.io/t/encryption-of-data-at-rest/37850/2 "2025-06-02T18:20:08Z")

</div>

hey @jcurrent

afaik there is no feature for encryption of data at rest buil-in in confluent server.

you could encrypt the volumes where your kafka data resides (with LUKS as you mentioned)

confluent cloud data is encrypted by default

> **[Kafka Security, Encryption & Compliance | Confluent Cloud](https://www.confluent.io/confluent-cloud/security/)**
>
> Connect, stream, and manage data with built-in security, encryption, monitoring, and compliance for all data, in real time. Secure your data in motion and data at rest.

let me know if you further insights

best,  
michael