#Encryption (SSE)

FileNest uses server-side encryption at rest (SSE) for all storage backends. The behavior differs by provider.

#Per-provider behavior

#How SSE-S3 works

When sse_enabled is true, FileNest sends the following header on every upload:

ServerSideEncryption: AES256

The storage server (MinIO/RustFS) uses its configured KMS key to encrypt the object. The encryption happens server-side — FileNest never holds the encryption key.

#Enabling SSE for MinIO / RustFS

#1. Configure the KMS key on the server

Set the environment variable on the MinIO or RustFS server process (not in FileNest):

# MinIO
export MINIO_KMS_SECRET_KEY="my-key:$(openssl rand -base64 32)"
 
# RustFS
export RUSTFS_KMS_SECRET_KEY="my-key:$(openssl rand -base64 32)"

#2. Toggle SSE in FileNest

Via the API:

curl -X PATCH https://filenest.drgodly.com/v1/projects/{id}/storage/sse \
  -H "Authorization: Bearer fn_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "sse_enabled": true }'

Or via the Console: Project Settings → Storage → Encryption at rest toggle.

#AWS KMS (SSE-KMS)

For S3 projects that need customer-managed keys, set server_side_encryption to aws:kms and provide the key ARN:

curl -X PATCH https://filenest.drgodly.com/v1/projects/{id}/storage \
  -H "Authorization: Bearer fn_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "server_side_encryption": "aws:kms",
    "kms_key_id": "arn:aws:kms:us-east-1:111122223333:key/mrk-..."
  }'

Customer-managed KMS (BYOK with envelope encryption) is planned for v2.0.