loader
How we protect your business Back to Security

Encryption at Rest

When your invoices, company details, and files are saved on ConvergeX, they stay encrypted on disk—so even if someone obtained raw storage media, your data would not be readable without the proper keys and access.

What this means for you

Encryption at rest protects information while it sits in our database, file storage, and backups—not only while you are logged in or sending data over the internet.

That means your invoice XML, PDFs, customer master data, tax records, and account details are stored using strong cryptography, with access limited to the platform and authorised operations staff—not left as readable files on open storage.

What is encryption at rest?

Encryption at rest refers to the protection of stored data using cryptographic techniques such that:

Confidentiality

Data cannot be accessed or read without proper authorization

Integrity

Data cannot be altered without detection

Security assurance

Even if storage media is compromised, data remains unreadable

This applies to all persistent storage systems including databases, backups, logs, and file repositories.

Your data we protect

Encryption at rest applies to the types of information you store and process in ConvergeX:

Stored records
Database
  • Invoice data (XML/JSON structured invoices)
  • Customer and supplier master data
  • Tax-related records and compliance data
  • User authentication and authorization data
Documents
Files & attachments
  • Uploaded documents (PDFs, attachments, supporting files)
  • Generated invoice documents
  • Archived records
Recovery
Backups
  • Automated database backups
  • Disaster recovery snapshots
  • System configuration backups
Operations
Logs & audit trails
  • Application logs
  • Security logs
  • Audit trails for compliance tracking

How we encrypt stored data

Your invoice & company database

All production databases are encrypted using:

  • AES-256 encryption standard (industry best practice)
  • Managed database encryption (e.g., AWS RDS / equivalent cloud provider)
  • Transparent Data Encryption (TDE) where applicable
Key features
  • Encryption is automatically applied to all stored data
  • No plaintext storage of sensitive information
  • Encryption enforced at the storage engine level

Uploaded & generated files

All files in object storage (e.g., AWS S3) are encrypted using:

  • Server-Side Encryption (SSE-S3 or SSE-KMS)
  • AES-256 encryption
Controls implemented
  • Encryption enabled by default on all storage buckets
  • Public access is strictly disabled
  • Access controlled via IAM policies

Backups & disaster recovery

All backup data is encrypted using:

  • AES-256 encryption
  • Encryption inherited from primary storage systems
  • Secure storage in isolated backup environments
Security measures
  • Backup access restricted to authorized roles
  • Backup retention policies enforced
  • Secure disaster recovery procedures in place

Logs & audit data

Operational and security logs are also stored on encrypted media so activity history is not exposed on raw disks.

You benefit from the same protection whether data is “live” or archived.

Encryption keys (managed for you)

Secure key storage

Keys are held in enterprise key-management services such as:

AWS KMS (Key Management Service) or an equivalent enterprise-grade solution

How keys are protected

  • Keys are never stored in plain text in the application
  • Only authorised infrastructure roles can use them
  • Key use is logged and reviewed by our operations team
  • Rotation follows our security policies

Built into the platform

The ConvergeX application does not ask you to manage encryption keys—cloud services handle that separately from your day-to-day invoicing workflows.

Who can access your data

Encryption works together with access controls so only the right people and systems can read stored data:

Role-Based Access Control (RBAC)
Multi-factor authentication for administrative access
Least privilege principle enforced
Database and storage access restricted via security groups and IAM

Standards & best practice

Our approach to encryption at rest is designed to meet expectations for modern e-invoicing and enterprise use:

ISO 27001–aligned controls GDPR-style data protection E-invoicing & tax data security Financial-grade storage practice

We also monitor storage access, review configurations regularly, and can revoke keys quickly if a serious security incident ever required it.

In summary

  • AES-256 and managed cloud encryption protect databases, files, and backups
  • S3 and RDS (or equivalent) are configured with encryption on by default
  • Your team uses ConvergeX normally—we handle keys and infrastructure security
  • Access is limited by roles, MFA for admins, and network controls

Want to know more about how your data is stored? Get in touch with our team.

Back to Security overview Contact us