Skip to content

Disk Encryption ≥0.3.0

Licensed only

This feature requires an enterprise license, except when decrypting an encrypted database. That operation is always permitted without an active enterprise license to prevent your data from being accidentally held hostage when a license expires.

Aspected supports encryption at rest for its on-disk database using SQLCipher (AES-256). When enabled, all persisted index data is encrypted transparently — reads and writes are decrypted in memory at runtime, while data on disk remains fully encrypted.

Enabling Encryption

To encrypt your data at rest, set the index.encryptionKey configuration option:

config.yml
index:
  encryptionKey: "my-secret-encryption-key"

Or via an environment variable:

export ASPECTED_INDEX_ENCRYPTION_KEY="my-secret-encryption-key"

When the server starts and finds an unencrypted database, it will automatically encrypt it using the provided key. Subsequent connections will use the key to decrypt data transparently.

Keep your encryption key safe

If you lose your encryption key, you will not be able to access your data. There is no way to recover an encrypted database without the correct key. The server will refuse to start if an incorrect key is provided.

Decrypting an Encrypted Database

To remove encryption from a previously encrypted database, set the index.decryptKey to the current encryption key and leave index.encryptionKey empty:

config.yml
index:
  decryptKey: "my-secret-encryption-key"

Or via an environment variable:

export ASPECTED_INDEX_DECRYPT_KEY="my-secret-encryption-key"

The server will decrypt the database on startup, leaving a plaintext SQLite database that is readable with any standard SQLite viewer. Once decryption is complete, you can remove the decryptKey from your configuration.

Crash-safe operations

Encryption, decryption, and key rotation operations are crash-safe. If the server is interrupted mid-operation, the database file may appear missing, but it will automatically be recovered on the next startup.

Key Rotation

To rotate the encryption key, set both index.decryptKey (the current key) and index.encryptionKey (the new key):

config.yml
index:
  encryptionKey: "new-encryption-key"
  decryptKey: "old-encryption-key"

The server will decrypt the database with the old key and re-encrypt it with the new key. Once rotation is complete, you can remove the decryptKey from your configuration.