Encryption is the security feature that every data room brochure mentions and almost nobody reads closely. “Bank-grade 256-bit encryption” appears on so many vendor pages that it has stopped meaning anything to buyers. That is a pity, because the details underneath the slogan answer a question that matters a great deal on a sensitive deal: if someone gets hold of the stored files, can they read them, and who besides you could decrypt them on purpose?
This guide walks through the encryption path a document takes inside a typical virtual data room, explains the terms you will see on security questionnaires, and lists the questions that get past the marketing.
What does encryption actually do in a data room?
Encryption turns a readable file into scrambled data that can only be turned back with the right key. In a data room it does one specific job: it makes stolen or intercepted copies useless. If an attacker captures network traffic, copies a storage disk or gets hold of a backup tape, encrypted files give them nothing without the keys.
It does not decide who is allowed to see a document. Once a bidder signs in and opens a contract, the system decrypts it for them, because they are authorized. Everything that controls authorized people, such as folder permissions, view-only mode, dynamic watermarks and the audit trail, sits in a different layer. Our guide to secure document storage in a data room covers those layers in turn.
Keeping that distinction in mind avoids the most common misunderstanding: encryption protects against outsiders and infrastructure failures, not against the people you invited.
How does a document travel through the encryption path?
The encryption path of one document
Follow one file, say a customer contract, from the seller’s laptop to a buyer’s screen.
Upload. The seller drags the file into the room. The browser and the provider’s server first agree an encrypted session using Transport Layer Security. The current version, TLS 1.3, is defined in RFC 8446; many providers still accept TLS 1.2 for older browsers. Anyone watching the network sees only scrambled traffic.
Processing. On the server the file is briefly in a readable state so the system can index it, create a preview, run optical character recognition or apply a watermark. This is the moment most people forget. It is normal and necessary, but it means the provider’s application can see the content.
Storage. Before the file is written to disk, it is encrypted with a data key, usually using the Advanced Encryption Standard. AES is specified by NIST in FIPS 197, and the 256-bit key length is the common choice for data rooms. Backups and replicas are encrypted the same way.
Key protection. The data key is itself encrypted with a master key held in a key management service or a hardware security module. This “envelope” approach means the master key never touches the stored files, and rotating it does not require re-encrypting every document.
Viewing. When the buyer opens the contract, the system unwraps the data key, decrypts the file and streams it to the browser over TLS again, often as rendered page images with a watermark rather than the original file.
What do AES-256 and TLS 1.3 mean on a questionnaire?
Security questionnaires are full of acronyms. Here is what the common ones tell you, and what they do not.
| Term | What it protects | What it does not tell you |
|---|---|---|
| TLS 1.2 / 1.3 | Files and passwords moving between browser and server | Whether old, weaker versions are still accepted |
| AES-256 at rest | Files on disks, in backups and replicas | Who controls the keys that unlock them |
| Envelope encryption | Separation between data keys and a master key | Where the master key lives and who can use it |
| HSM / KMS | Master keys held in tamper-resistant hardware or a managed service | Whether the provider’s staff can call that service |
| Customer-managed keys (BYOK) | Your ability to revoke the provider’s access to the master key | How quickly revocation takes effect across caches and backups |
| End-to-end encryption | Files that only the sender and recipient can decrypt | Rarely offered by data rooms, because it blocks search, previews and watermarking |
The last row deserves a word. Full end-to-end encryption, where the provider never sees readable content, is rare in deal rooms for a practical reason: the features buyers expect, such as full-text search, in-browser previews, dynamic watermarks and AI-assisted indexing, all need the server to read the file. A provider claiming end-to-end encryption alongside those features should be asked to explain exactly where decryption happens.
Who holds the encryption keys?
This is the question that matters most, and the answer usually falls into one of three models.
Provider-managed keys
The default. The provider generates, stores and rotates all keys, typically inside its cloud platform’s key management service. It is simple, it works, and for most transactions it is adequate. The trade-off is trust: technically, the provider can decrypt your files, so you rely on its internal controls, staff vetting and audits to stop it doing so without reason.
Customer-managed keys
You hold or control the master key, usually in your own cloud key management account, and grant the provider permission to use it. If you withdraw that permission, the provider can no longer unwrap data keys and your files become unreadable to it. Banks, large corporates and some regulated sellers ask for this. It adds setup work and a real operational risk: lose the key, and you lose the data.
Provider-held keys with split access
A middle path some vendors describe: keys stay with the provider, but use requires approval from more than one person, every use is logged, and staff access to production data is restricted and audited. This is less visible than customer-managed keys but meaningful when it is documented in an independent audit report.
Practical test
Ask the provider one plain question in writing: “Under what circumstances can your staff read our documents, and how would we know?” A strong provider answers with named controls, logging and an audit reference. A vague answer about “military-grade encryption” tells you the question was not understood.
Does encryption satisfy privacy and security rules?
Encryption is named in many legal and regulatory texts, but it rarely satisfies them on its own. Article 32 of the EU General Data Protection Regulation lists encryption as one example of an appropriate security measure, alongside the ability to keep systems confidential and resilient and to test them regularly. Encrypted personal data can also change the analysis after a breach, because data that remains unintelligible to an attacker may lower the risk to the individuals concerned.
What regulators and auditors look for is a managed system: encryption plus access control, key management procedures, logging and testing. That is why independent assurance matters more than the encryption claim itself. Every provider in our directory holds a SOC 2 report, and most also hold ISO 27001 certification; both assessments cover how keys and cryptographic controls are managed, not only whether encryption is switched on. If personal data will cross borders during a deal, our region guides summarize the main privacy laws by country.
Where does encryption stop protecting your documents?
Being honest about the limits helps you put the rest of your security effort where it counts.
- An authorized user with bad intentions. The system decrypts files for anyone it lets in. Permissions, view-only access and watermarks are the controls here.
- A stolen password. If an attacker signs in as a real user, encryption treats them as that user. Two-factor login is the defense; twelve of the sixteen providers in our directory offer it.
- Downloaded copies. Once a file leaves the room as an ordinary PDF, the room’s encryption no longer applies. Document rights management can keep a downloaded file encrypted and revocable, which is why it is worth checking separately.
- Screens and phones. Nothing stops a camera pointed at a monitor. Watermarks make the resulting image traceable.
- The processing window. While a file is being indexed or previewed, it is readable on the server. That is a provider-side risk managed by infrastructure security, not by encryption at rest.
Encryption is a floor, not a differentiator. A provider that lacks it should be ruled out at once; a provider that has it has only met the minimum.
What should you ask a provider about encryption?
Short, specific questions get useful answers. Send these with your security questionnaire, or use them in a demo:
- Which TLS versions do you accept, and do you reject TLS 1.0 and 1.1?
- Which algorithm and key length encrypt stored files, backups and replicas?
- Do you use envelope encryption, and where are master keys held: a cloud key management service, dedicated hardware, or something else?
- How often are keys rotated, and is rotation automatic?
- Can we bring or control our own master key, and what happens to cached previews if we revoke it?
- Can your employees access decrypted documents, under what approval process, and is that access logged?
- Do downloaded files stay encrypted under rights management, and can we revoke them after the deal?
- When the room is deleted, are the keys destroyed too, and will you confirm that in writing?
The last question links encryption to the end of a deal. Destroying the keys for a closed room, sometimes called crypto-shredding, makes any leftover copies on backups unreadable. It is a neat answer to the awkward question of how a cloud provider can prove deletion.
How does encryption affect cost and features?
For most buyers, encryption has no visible price. In-transit and at-rest encryption come with every room. Customer-managed keys are a different matter: where offered, they tend to sit in enterprise contracts and add setup time with your IT team, and they make support harder because the provider cannot inspect files you have locked away from it.
There is also a feature trade-off. The more tightly a file is locked against the provider, the less the platform can do with it. Search, previews, automated indexing and AI summaries all need readable content on the server. If those features matter to your team, accept provider-side decryption under strong, audited controls rather than chasing an end-to-end model that disables them. Our VDR pricing guide shows where advanced security features usually sit in a provider’s tiers.
How do you weigh encryption against everything else?
A sensible order of priorities, for most sellers and advisers:
- Confirm the baseline: modern TLS, AES-256 at rest, encrypted backups.
- Read the independent audit reports and check that their scope covers the product you will use.
- Ask who can decrypt your documents and how that access is logged.
- Decide whether your deal genuinely needs customer-managed keys, usually only for regulated data or a demanding counterparty.
- Spend the remaining attention on permissions, two-factor login, rights management and the audit trail, where most real incidents are prevented or traced.
That ordering reflects how deal leaks actually happen. Very few involve breaking encryption. Most involve someone who was allowed in.
Compare providers on two-factor login, rights management and certifications side by side.
Compare providersFAQ
What encryption do virtual data rooms use?
Most use TLS 1.2 or 1.3 to protect files in transit and AES with 256-bit keys to protect files at rest, including backups. Keys are usually protected with envelope encryption inside a key management service or hardware security module.
Can a data room provider read my documents?
With provider-managed keys, technically yes, because the server decrypts files for previews, search and watermarking. Good providers restrict and log any staff access and have it independently audited. Customer-managed keys let you revoke that ability.
What are customer-managed encryption keys?
A setup where you control the master key, typically in your own cloud key management account, and grant the data room permission to use it. Withdrawing permission makes the stored files unreadable to the provider.
Is a data room end-to-end encrypted?
Rarely. End-to-end encryption would stop the server from reading files, which disables search, previews, dynamic watermarking and AI indexing. Most rooms use strong encryption in transit and at rest instead.
Does encryption stop leaks from a data room?
Only leaks of stolen or intercepted copies. Leaks by authorized users are controlled by permissions, view-only access, watermarks, rights management and the audit trail.