# Protect your data

Understand how data is encrypted, isolated, backed up, and recovered.

Canonical: https://docs.deliberate.space/data/protection/

Use this page to decide whether the default encryption, isolation, and recovery
controls meet your application's requirements. These layers solve different
problems: encryption protects bytes and traffic, isolation limits access, and
backups recover deleted or corrupted data.

## Stored data

The storage classes deployed for tenant databases and durable volumes encrypt
data at rest. The apply path also checks the selected class and rejects a
backend it can identify as unencrypted or unapproved. If the class is unset or
the platform API cannot read it, the current guard warns and continues; the
deployed storage configuration, rather than that guard alone, therefore carries
the guarantee today.

Protected PostgreSQL backups add two independent layers:

1. WAL-G encrypts every database archive client-side with a unique 256-bit
   libsodium key before it leaves the database environment.
2. The EU object store encrypts the already-encrypted archive again at rest.

The database key is wrapped by OpenBao and stored separately from the archive.
A storage credential by itself therefore exposes encrypted objects, not database
plaintext. Backup paths are scoped to an opaque database identity so recreated
databases do not accidentally join an older encryption chain.

Volume backups are encrypted by their storage and object-storage substrates.
They do not currently add the database-specific client-side encryption layer;
the distinction is intentional and documented rather than hidden behind a
generic “encrypted” badge.

## Network traffic

- Public application routes terminate with platform-issued TLS certificates.
- Platform APIs and object-storage backup traffic use TLS.
- Private Net encrypts device-to-platform traffic with WireGuard.
- Cilium encrypts traffic between managed endpoints when it crosses cluster
  nodes; same-node traffic does not traverse the WireGuard tunnel.
- Private routes are not exposed through the public application route.

Encryption in transit does not make a public route private. Choose route
visibility based on who should be able to connect, then use Team-level Private
Net grants for internal services.

Public platform-generated HTTP routes also pass through the origin web
application firewall before reaching the component. Read [Web traffic
protection](/operate/web-traffic/) for its rules, coverage boundaries, blocked
responses, and false-positive workflow.

## Access to data and credentials

Each Environment runs in its own namespace. Inbound dependency access is
default-deny: a component must declare a database, bucket, or Blueprint
dependency before the platform wires the corresponding network and credential
path. A volume is mounted only into the component that declares it. Private Net
authorization is granted to Team members rather than to copied VPN
configuration files.

Secrets are stored in OpenBao as the source of record. The workload receives
only the values it declared, materialized through its isolated runtime secret;
secret values are not written into your project YAML or exposed by `pull`.
Database application passwords are generated and maintained by the platform,
and additional database roles are bounded so they cannot request superuser or
replication privileges.

## Recover deleted or corrupted data

Encryption cannot recover a file that an authorized application deleted.
Snapshots and database archives provide that separate protection:

- database-native base backups and continuous WAL support point-in-time
  recovery for protected database tiers;
- volume policies select in-cluster or off-site recovery points;
- restore operations stage a new copy before a handoff; and
- automated database restore drills test the technical recovery path rather
  than merely checking that backup files exist.

## Your responsibilities

deliberate. runs the infrastructure automation, isolation controls, credential
machinery, backup schedules, and technical restore checks described here. Your
team still decides who may read data once it is connected, which data may be
copied into previews, which recovery point is correct, whether the recovered
application is usable, how long business records must be retained, and whether
an independent export is required for portability or compliance.

For security questions that depend on your threat model or regulatory scope,
contact the deliberate. team before treating a platform default as a compliance
control.

## Next steps

- [Choose a database protection tier](/data/databases/)
- [Choose a volume backup policy](/data/volumes/)
- [Review the complete application security boundary](/security/)