Encryption at rest
Review storage encryption and application-level protection separately. Azure data services provide managed encryption at rest; VeriProof also protects selected captured content and credential material.
For a field-level claim, identify the data store, protection method, key, and owner. One encrypted store does not establish how every copy is protected.
Data categories
| Category | Protection to review |
|---|---|
| Session metadata and governance records | Azure storage encryption, database access, backup, retention, and deletion |
| Captured prompt or response content | SDK capture choice, redaction, supported content protection, and access |
| Application SDK keys | One-time display, stored hash representation, rotation, and revocation |
| OAuth and integration secrets | Key Vault storage, access, versioning, and rotation |
| Evidence exports | Export encryption, transfer, destination storage, and retention |
| Proof references | Provider-specific public or private boundary |
Content capture
Content capture is disabled by default in the core SDKs. When enabled, test the exact model and adapter path.
Pattern-based redaction masks values that match supported patterns. Inspect representative records and exports; unmatched personal, health, financial, or confidential data may remain.
Backups
Backup copies can extend the life of encrypted data and key dependencies. Include backups, replicas, exports, and protected ledger digests in retention, restore, and deletion planning.
Key changes
Before changing a key, identify the services and retained records that depend on it. Follow its rotation or deletion workflow and verify recovery before retiring a version.
A storage-service encryption setting does not prove that every export, log, backup, or third-party destination follows the same boundary.