Encryption at Rest

Couchbase Server uses physical media to store files and indexes. If media are stolen, data becomes vulnerable to illicit access.

Therefore, to secure such data, encrypt all important data and index storage-locations, using transparent data encryption, provided by 3rd party on-disk encryption software-vendors; which denies data-access to anyone who either does not possess an appropriate encryption-key, or is otherwise non-compliant with the configured security policy. Such encryption ensures that stored data cannot be compromised; even if the database is stolen, copied, lost, or otherwise improperly accessed.

Commonly used 3rd party encryption tools include:

The tools listed above all allow either full disk or file-level encryption to be used. If file-level is chosen, the following Couchbase directories and files should be encrypted: