Encryption at rest
Encryption at rest is the practice of storing data on disk in encrypted form so that a database breach or stolen disk does not expose the contents. For AI agents, encryption at rest is the baseline for storing user credentials, conversation memory, and OAuth tokens.
Why it matters
Production AI agents accumulate sensitive user data: OAuth tokens that grant access to your email and bank, conversation memory that includes personal facts, custom tool credentials. Storing any of this in plaintext is a breach waiting to happen. Encryption at rest is the baseline mitigation: even if the database is compromised, the bytes on disk are useless without the encryption key.
The pattern works because the encryption key lives separately from the encrypted data. An attacker who steals the database does not also automatically have the key; they get encrypted bytes. The trade-off is operational complexity (key management) and a small performance cost on read/write paths.
Most modern cloud infrastructure provides encryption-at-rest by default at the disk-volume level (AWS EBS encryption, Postgres on AWS RDS with encryption enabled). Application-level encryption-at-rest is an additional layer: even within an encrypted disk, individual sensitive fields (OAuth tokens, secrets) are encrypted before being written, using a key managed by the application.
The threat model encryption-at-rest addresses is "stolen disk" or "database breach." It does NOT address "compromised application server" (the server has the key, so it can decrypt). Defense-in-depth means combining encryption-at-rest with per-user isolation, audit trails, and limited blast radius.
How Ajeris handles this
Ajeris's database is encrypted at rest by its hosting provider (AES-256). Credentials get a second layer: vault passwords and authenticator keys, OAuth tokens and custom-MCP bearer tokens are encrypted with industry-standard symmetric encryption under a key held apart from the database, so a database breach yields encrypted bytes for them. Memories and conversations rely on the provider's disk encryption and on row-level security.
Combined with per-user isolation and tenant isolation, the threat model is bounded: a compromise of one user's data cannot reach another user's data, and a stolen disk yields nothing.
