Encryption & key custody

AthenaDB encrypts data at rest with its own AEAD stack (ChaCha20-Poly1305, HMAC, SHA-256) and page-level encryption. There is no bundled third-party database or crypto library inside the engine.

What that means

• Storage format and crypto are Athena-owned and auditable as one surface.
• Real (sensitive) data ingestion stays gated behind a signed clearance attestation enforced in the engine — see Security.
• OS-backed key custody (Windows CNG/DPAPI-style, macOS Keychain, PKCS#11 on FreeBSD/Solaris lanes) is part of the platform design; production HSM / government fail-closed custody policies continue to land with evidence.

What is planned

Hardware HSM devices, air-gapped government custody profiles, and full cross-platform verified parity remain registry-tracked work — not GA claims.

Related: Security model · Architecture