Encryption at rest
Camunda 8 SaaS cluster data is encrypted at rest to provide security and protection for your data.
Overview​
By default, Camunda 8 SaaS cluster data at rest is protected with a provider-managed encryption key using Google Cloud Platform (GCP) encryption. The encryption key is owned and managed by GCP.
Enterprise customers requiring a higher level of protection can select a dedicated Camunda-managed software or hardware (HSM) encryption key when creating a new cluster. The encryption key is managed by Camunda using Google Cloud Key Management Service (KMS).
- You can only select the encryption type when creating a cluster. You cannot change the encryption type after cluster creation.
- You can configure encryption keys on a per-cluster basis so that each cluster has a dedicated encryption key. Encryption keys can be configured for all cluster versions.
- You can view cluster encryption key details in Cluster Details on the Console Overview tab.
Backups use the default provider GCP encryption.
Encryption types​
The following table summarizes the available types of cluster encryption at rest.
| Encryption type | Managed by | Protection level |
|---|---|---|
| Provider encryption key (default) | Google uses a FIPS 140-2 validated encryption module (certificate 4407) in our production environment. | |
| Software encryption key | Camunda |
|
| Hardware encryption key | Camunda |
|
Provider encryption key (default)​
By default, Camunda 8 SaaS cluster data at rest is protected using GCP encryption.
- Provider encryption keys are owned and managed by GCP.
- Google uses a FIPS 140-2 validated encryption module.
Learn more about Google default encryption at rest and default provider encryption settings.
Camunda-managed software encryption key​
Camunda-managed software encryption keys use the Google KMS software protection level to provide a higher level of protection than default provider encryption.
- Requires an enterprise plan.
- Software encryption keys are managed by Camunda.
- Software encryption keys are compliant with FIPS 140-2 Level 1.
- Cryptographic operations are performed in software.
- Rotated with zero downtime for security and compliance.
Camunda-managed hardware encryption key​
Camunda-managed hardware encryption keys use the Google KMS hardware protection level to provide a higher level of protection than both default provider encryption and Camunda-managed software encryption keys.
- Requires an enterprise plan.
- Hardware encryption keys are managed by Camunda.
- Hardware encryption keys are compliant with FIPS 140-2 Level 3.
- Rotated with zero downtime for security and compliance.