# Encrypting Data

Data encryption enhances the security of an application by securing content that may be considered sensitive data. For example, when building out an application that captures a social security number, this data can be considered sensitive and would need to be encrypted. In this document, we discuss how to encrypt any data stored in Airkit's back-end.

## Encryption Keys

Encrypting and decrypting data requires an encryption key. There are two options when using encryption keys within Airkit: you can either use the default keys provided by Airkit or configure your own.

### Default Keys

Every Airkit Organization get encryption keys automatically provisioned for each datastore (Development, QA, and Production). These keys are created using [AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html) and are provisioned with the default configuration.

![organizing info](https://2093598723-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC2DgLBPTrwoEhWaU24LL%2Fuploads%2Fgit-blob-47089fae37a97e98c24edea53def2d77c2d2ab86%2Fencrypting-data-v180-0.png?alt=media)

### Bring your own Keys

If the default key configuration does not meet security requirements, a [custom AWS KMS Key](https://aws.amazon.com/kms/features/#Custom_Key_Store) can be created outside of Airkit and be associated to a datastore.

To create a custom encryption key, go to [console.airkit.com](https://console.airkit.com) > Settings > Encryption Keys and select **Create new**.&#x20;

![organizing info](https://2093598723-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC2DgLBPTrwoEhWaU24LL%2Fuploads%2Fgit-blob-819955e480f69af6a5bb22521d83427dc7afb38d%2Fencrypting-data-v180-1.png?alt=media) ![organizing info](https://2093598723-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC2DgLBPTrwoEhWaU24LL%2Fuploads%2Fgit-blob-ef04f46c34bed1c360f25c8cbfed6ecf51efbcb2%2Fencrypting-data-v180-2.png?alt=media)

Enter a name for the custom key and pass the Reference Key. The reference key is the Amazon Resource Name (ARN) of the KMS Key. For more on finding the ARN see [documentation on AWS](https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html).&#x20;

## Encrypting Fields in AirData

Fields in AirData can be encrypted to secure sensitive content using the encryption key associated with the application. To associate an encryption key to an app, open the relevant app in the Studio and select an encryption key from the dropdown menu provided in [**Settings**](../studio/builder-bar/settings) **-> Encryption**.

![](https://2093598723-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC2DgLBPTrwoEhWaU24LL%2Fuploads%2Fgit-blob-46af5db6cc27b02389af54963fb127430767f9fd%2Fencrypting-data-v180-3.png?alt=media)

To AirData App Object attributes, go to AirData Builder and select one of the Object attributes. In the Inspector, check the **Encrypt** checkbox.

![](https://2093598723-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC2DgLBPTrwoEhWaU24LL%2Fuploads%2Fgit-blob-2fdd4162608fddae08d717240b09e8197d9aef95%2Fencrypting-data-v180-4.png?alt=media)

This will encrypt that field when the data is stored.

> 📘 When a field of data is encrypted, that field cannot be used to query or filter as part of an [AirData Request](../data-operations/airdata-request-data-operation).
