S3 Data Encryption – SSE-C and SSE-S3

• Client-side encryption (CSE)

Allows customers to encrypt their data on their devices before sending it to the Fstorage server for storage. This ensures that the data remains encrypted throughout its entire lifecycle, providing a high level of security because the customer manages the encryption keys, which are never shared with Fstorage or any third parties. This approach requires customers to manage their keys carefully, but it is an ideal solution for those needing complete data security control.

• Server-side encryption (SSE)

Provides an alternative solution where data is encrypted when it reaches the Fstorage server. This is Fstorage’s responsibility, significantly reducing the security management burden on customers. There are two methods of server-side encryption:

• SSE-C - Server-Side Encryption with Customer Keys: Customers can provide and manage their own encryption keys, giving them full control over data security. This option is particularly suitable for organizations with specific compliance and data security needs, as it allows exclusive management of encryption keys.

• SSE-S3 - Server-Side Encryption with HI GIO S3 Cloud-Managed Keys (in development): This simplifies the encryption process by using keys managed by Fstorage. This method is ideal for customers who want a robust encryption solution without the complexities of key management. It integrates the use of KMS (Key Management Service).