AI platform encryption and backups: what to check
Understand encrypted disks, KMS and backup recovery in RN. Separate protection at rest from permission to use data.
Rota Nacional · Published · Reviewed
A closed disk requires authorization
Rota Nacional stores Docker, databases and operational files on a LUKS-protected volume. The environment starts closed. The owner must authorize opening it before the public service starts.
This control reduces exposure of the closed volume. During operation, authorized processes need access to data and memory. Disk encryption does not replace authentication, application maintenance or organization isolation.
The root key stays in KMS
AWS Key Management Service, or KMS, protects the data keys of encrypted envelopes. The root key stays in that service. The RN vault uses Nitro Enclaves attestation to bind operations to the approved image.
An envelope copy is not enough to open it. Recovery also requires the correct KMS key, authenticated context and specified authorization. Encrypted copies and recovery procedures therefore belong together.
Backups need a recovery check
The current daily database backup is encrypted before upload. Recovery of this format uses temporary owner authorization limited to the file. Copies from before the migration have a separate procedure. The server role cannot delete backups or their historical versions.
RN checked an encrypted copy and the recovered SQL stream without overwriting the active database. This check applies to the examined file. It is not a complete disaster recovery exercise.
Sealed configuration has a separate copy. It requires an update after changes; the daily database backup does not update it automatically.
Retention remains an organization decision
Encryption does not authorize unrestricted storage. In Bots, the organization chooses whether to record conversations and memory. With recording disabled, the module keeps content temporarily in RAM. Earlier audits and backups retain their own retention periods.
This recording option is not yet available for other API routes. Their audit path uses a global capture control and an organization retention period, subject to a global minimum. Financial records have a separate purpose. Check retention for the route you use before integrating real data.
Frequently asked questions
Does disk encryption protect everything while the service is open?
No. The application and database must process data during use. LUKS protects the closed volume. The vault, permissions and organization policy protect other parts of the flow.
Can I disable recording for every route?
The organization recording option is available in Bots. Other routes still use the global audit capture control and applicable retention period. Disabling Bots does not immediately remove earlier audits or backups.
Keep reading
HTTPS, DNSSEC and certificates: how RN protects your connection
See how ACM certificates, enclave key operations and signed DNS protect the RN entry point. Understand the scope of each control.
How RN protects AI API keys with KMS and Nitro Enclaves
See how Rota Nacional separates its application, vault, certificates and encrypted disk. Understand the limits of these controls.
Require privacy across your organization's API keys
An organization can require the RN privacy barrier. Understand native API blocking, the 403 error and the protected chat path.