Security questionnaire answers › Data protection
Do you encrypt customer data at rest? How to answer it in a security questionnaire
Why buyers ask this
Buyers want to know that a stolen disk, backup or database snapshot would not expose their data in readable form.
What a strong answer includes
- State yes or no first, then name the algorithm and scope (for example AES-256 for databases, object storage and backups).
- Say who manages the keys (cloud provider KMS, customer-managed keys, or your own HSM).
- Cover backups and logs, not just the primary database.
- Mention key rotation and who can access keys.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. Customer data is encrypted at rest using AES-256 in [database/service], [object storage] and all backups. Encryption keys are managed in [cloud provider] KMS, rotated at least [annually], and access to keys is restricted to [named roles] and logged.
Evidence to attach
- Cloud provider encryption settings screenshot or configuration export
- Key management policy
- Backup configuration
Common mistakes
- Answering yes when only the database is encrypted and backups or logs are not.
- Listing an algorithm without saying who controls the keys.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.