Transparent Data Encryption for Synced Record Types

Overview

In addition to disk encryption, you can use transparent data encryption for the data service to protect your synced data at rest.

This page explains how transparent data encryption works and how to enable it for your environment.

How it works

When you enable transparent data encryption, data is encrypted in real-time within the data service before being written to disk, and decrypted when queries are executed. As a result, no unencrypted data is persisted to disk. This provides another level of protection against unauthorized access to the filesystem or to the physical drives.

This form of data at-rest encryption is referred to as transparent data encryption (TDE) because it is transparent to the application layer.

With transparent data encryption for the data service, you manage the encryption keys using your own AWS Key Management Service (KMS) account. If you have enabled database encryption for the MariaDB Cloud database, the same customer managed key (CMK) should be used for encrypting synced data in the data service.

Transparent data encryption for synced data uses your customer managed key (CMK) for two purposes:

• To generate a data encryption key (DEK), which is stored in encrypted format within the data service on initial startup.
• To decrypt the data encryption key (DEK) on subsequent restarts for use within the data service.

Enable transparent data encryption for synced data

To enable transparent data encryption for synced data:

1. Configure Bring Your own Key (BYOK).
2. Create a support case to request data service encryption.

Additional details

This section provides more information about managing transparent data encryption for your synced data.

Key rotation

You can rotate both your data encryption key (DEK) and customer managed key (CMK):

• DEK rotation: Your data encryption key (DEK) can be rotated by an Appian support engineer. Open a support case to request data encryption key rotation.

• CMK rotation: Appian supports Amazon's built-in automatic AWS CMK rotation. Automatic rotation maintains access to the old key for decryption and maintains the same key metadata. Manual key rotation is not supported.

  Caution:  If you need to remove an AWS CMK, Appian recommends disabling the key instead of deleting it. Deleting an AWS CMK will delete the key material and all associated metadata, and this action is irreversible. If encryption is not disabled prior to the CMK deletion, the encrypted synced data stored within the data service can not be recovered and must be resynced into Appian.

Encryption of data service logs

All log files that may contain any data values written to or retrieved by the data service will be output in encrypted format.

Transport layer encryption

Data in transit between the data service and other platform components is encrypted using the Transport Layer Security (TLS) protocol. No additional configuration is required.

Disable encryption

To disable transparent data encryption for your synced data, open a support case. Your support contact will guide you through the process.

Feedback