--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Exploring Database Encryption # Exploring Database Encryption {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exploring Database Encryption ServiceNow provides database encryption (DBE) to safeguard data at rest, using symmetric AES-256 encryption. This ensures comprehensive protection of all stored data, whether the database is online or offline. However, as of the Australia release, Database Encryption has entered its End of Life phase, with End of Sale and End of Renewal milestones reached. Customers are encouraged to transition to the newer Cloud Encryption with Key Management solution for data at rest protection. Show full answer Show less ## Key Features * **Real-time AES-256 Encryption:** All data, including tables and activity logs, is encrypted as it is stored and decrypted in memory when accessed, ensuring no impact on application functionality. * **Full Disk Encryption:** Protects offline data from loss or theft by encrypting entire disks. * **Transparent Operation:** Encryption is seamless to users with no loss of ServiceNow features or performance impact beyond a minor 5% on instance cloning. * **Comprehensive Coverage:** Encryption applies to all instances, replication traffic, and backups. * **Three-Level Key Hierarchy:** ServiceNow manages encryption keys securely using a tiered system involving customer-specific AES-256 keys protected by FIPS 140 validated appliances, ensuring strong key management and isolation per customer instance. * **Customer Controlled Switch (DBE with CCS):** Supports customer-supplied keys to encrypt all data at rest without affecting application logic, maintaining data unencrypted only during active use. ## Important Considerations for ServiceNow Customers * Database Encryption is not supported for on-premise instances; it is designed for ServiceNow cloud environments. * Due to the End of Life status of Database Encryption, customers with existing implementations should plan migration to Cloud Encryption with Key Management. * New and existing supported platform releases can utilize Database Encryption, but new deployments are recommended to adopt the successor solution for ongoing support and compliance. ## Practical Benefits By leveraging Database Encryption, customers can meet statutory data protection requirements for at-rest data, ensuring sensitive information is encrypted without compromising ServiceNow platform functionality or performance. The solution simplifies compliance while maintaining seamless user experience and operational efficiency. ServiceNow® offers database encryption (DBE) and full-disk encryption methods for customers with statutory obligations for data protection which may require at-rest protection for all data. Important: Database Encryption has begun its End of Life process and has reached the End of Sale and End of Renewal milestones as of the Australia release. Cloud Encryption is the replacement solution for data at rest encryption. For details, see [Cloud Encryption with Key Management](https://www.servicenow.com/docs/Sn~ZSQuEMVyrZq5fH1FKDw "ServiceNow Cloud Encryption offers encrypted storage for the database using block encryption, along with enhanced key management. Cloud Encryption is available with the ServiceNow Platform Encryption subscription bundle.") Database Encryption enables all data to be protected with symmetric AES-256 encryption, whether the database is online or offline. From the ServiceNow AI Platform perspective, all data flows in decrypted. * Database Encryption supports all stored data to be encrypted in real time providing protection for data online and offline with no loss of functionality. * Full disk encryption protects offline data if there is disk loss or theft. {#explore-database-encryption__ul_spg_1rz_xqb} With Database Encryption, all stored data is encrypted and individual records or tables are decrypted in memory while being accessed. New or changed data is encrypted as it is entered into a table and associated activity log files (bin, redo, undo, and error) are also encrypted. Database Encryption is transparent to users, with no loss of functionality. When using this feature, all instances are encrypted, along with replication traffic and backups. Instance cloning is still available with a minor performance impact for using Database Encryption of up to 5%. Both new and existing instances on supported releases of the ServiceNow AI Platform can take advantage of database encryption. As illustrated, ServiceNow stores and manages keys using a three-level key hierarchy: 1. A customer specific AES-256 key is created by the database engine and is used to encrypt the data. 2. A second customer specific AES-256 key is created by the database engine and is used to protect the first-level key. 3. A third AES-256 key is created by and stored within FIPS 140 validated key management appliances in the ServiceNow datacenters. This key protects the second-level key and is unique per customer instance. {#explore-database-encryption__ol_djw_sbr_qlb} The ServiceNow AI Platform also supports database encryption with a customer supplied switch, DBE with CCS. This is an encryption solution that encrypts all data-at-rest when not in use in the database. It uses industry standard AES encryption with no impact to functionality. The database encrypts data as it is written to the disk, and decrypts data as it is read from the disk. That means that applications always have the data in an unencrypted state to perform the necessary logic and functions without impact. Note: Database Encryption is not supported for on-premise instances. If you are using your own keys for database encryption, see [Database Encryption with Customer Controlled Switch](https://www.servicenow.com/docs/X0q8XDaoadcTvvGdnXwycQ "Database Encryption with Customer-Controlled Switch (DBE-CCS) is an encryption solution that encrypts all data-at-rest when not in use in the database.").