What “encrypted at rest” means

Encryption at rest protects sensitive information while it is stored in a database, on a server drive, in cloud storage, or in a protected backup. Instead of being stored in readable form, the sensitive value is converted into coded data called ciphertext.

How it works

When protected data is saved, the GBHC system automatically encrypts it in the background using a strong encryption algorithm and a separate encryption key, saving that ciphertext instead of an ordinary readable value. When an authorized GBHC function needs the information, the system uses the correct key to decrypt the ciphertext temporarily for that authorized use. If the information is displayed in your browser, it is delivered to that authorized session over HTTPS.

This means that obtaining a database copy or storage file by itself should not reveal the protected names, member numbers, phone numbers, email addresses, notes, or electronic signatures. The encryption key is required to turn the ciphertext back into readable information.

Secure member lookups

For member-number, phone, and email matching, GBHC also uses secure keyed lookup values. This lets the system determine whether the information entered matches a member record without keeping a readable searchable list of those identifiers in the database.

Why it matters

• Unauthorized-access protection: encryption adds another layer of protection beyond usernames, passwords, and database permissions.
• Reduced breach exposure: stolen encrypted storage is much less useful without the separate decryption key.
• Backups: sensitive exported data and backups should remain encrypted, with recovery keys stored separately and securely.
• Security and compliance: encryption at rest is a widely used safeguard in regulated environments such as healthcare and payment processing. Which legal or industry requirements apply depends on the organization and the data involved.
• Member confidence: Cory Bredow and GBHC are intentionally designing the membership and waiver systems so sensitive information is not kept as an ordinary readable member list.

Important: encryption at rest protects stored data. It works together with secure logins, access controls, HTTPS while data is traveling, software updates, backups, and careful key management. These measures help keep data safer but do not stop every possible form of data collection or compromise, such as scanning or malware on a client-side device. Encryption at rest does not replace those other protections.