You can enable file encryption and decryption on all files that are saved to a SDx server vault by selecting the site settings File Encryption property. By default this property is set to False. For more information, see Site Settings node properties.
When this property setting is enabled, any file created, updated, or imported is encrypted as it is saved to the vault. Conversely, when a file is viewed in the system or exported out of the vault, it is automatically decrypted.
-
Administrators can disable file encryption on an existing site, but encrypted files in a vault remain encrypted and are only decrypted when viewed or exported.
-
You can move an encrypted vault within a database backup and move it to another server and site.
-
The file encryption used by SDx is based on the Advanced Encryption Standard (AES-128) symmetric algorithm. This is not configurable. AES-128 uses a 128-bit key length to encrypt and decrypt blocks of messages. This is a fast and secure global standard for encryption.
-
File encryption generates a random encryption key for the site. Once the key is generated and stored in the database, it does not change for that site, even if the encryption setting is enabled and disabled for the site multiple times. The encryption key is also used to decrypt files even when file encryption is disabled.