We use AES-256 encryption for data at rest across all storage layers — databases, blobs, and backups.

By integrating Azure Key Vault with Bring Your Own Key (BYOK), you retain exclusive control over key generation, rotation, and revocation. Only authorized identities and applications can decrypt your sensitive data.