Wasabi is secure by default and all data stored in Wasabi hot cloud storage is always encrypted at rest (even if the data is already encrypted by the storage application prior to sending it to Wasabi). Wasabi follows industry-best security models and security design practices. Examples of Wasabi security features include:
- HTTPS is supported for the secure upload/download of data
- Buckets are only accessible to the bucket and object creators
- Wasabi supports user authentication to control access to data
- Access control mechanisms such as bucket policies and Access Control Lists (ACLs) can be used to selectively grant permissions to users and groups of users
Additional general info on Wasabi and security can be found here.
Additional specific info on Wasabi's encryption at rest methods is provided below:
Wasabi system software always encrypts object data before it is written to a disk drive. Encryption is done using a AES256-bit key that can be provided in two different methods. If the S3 client app provides an encryption key in the S3 PUT Object Data REST request (the SSE-C approach described here), that key is used to encrypt the object data before writing to disk. After the PUT Object operation is completed, the key is discarded. The S3 client app must provide the same encryption key in an S3 GET Object REST request to access the data. The Wasabi system software does not keep a copy of the encryption key and it is only stored temporarily in memory while the object is being encrypted.
If no key is provided by the S3 client app (meaning SSE-C is not used), then a random AES256-bit key is generated using a cryptographic random routine in Wasabi's software. A different encryption key is generated for each object stored in the system.