Encrypt data at rest and in transit. At-rest options:
- Server-side encryption: cloud provider manages keys (SSE-S3, SSE-KMS)
- Client-side encryption: you encrypt before upload
- Full-disk encryption: encrypt entire volumes
KMS (Key Management Service) handles key rotation. Encryption adds minimal overhead with hardware AES support.