As Sitecore 9 is all about Data security, clear seperation and so on, we would obviously like to put those features to work.

That is why we were wondering how the Stale data encryption that was mentioned on the xDB data actually works. Is this an application (specific) level implementation or does it use SQL TDE (Transparent Data Encryption) now that Sitecore 9 has come back into the sql fold with analytics databases.

I looked around the documentation but could not find anything specifc on this, only reference I found is on commerce and that is a best-practice advise: http://commercesdn.sitecore.net/SCpbCS81/SitecoreCommerceDeploymentGuide/en-us/DataEncryption.html

Thanks in advance

3 Answers 3


Prior to Sitecore 9, TDE could be used to configure data-at-rest encryption. Always Encrypted was introduced in SQL Server 2016, thus TDE was the only option for data-at-rest encryption and SSL for data-in-motion.

Always Encrypted is available in SQL Server 2016 (13.x) and SQL Database. (Prior to SQL Server 2016 (13.x) SP1, Always Encrypted was limited to the Enterprise Edition.) https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-2017

Sitecore 9 supports SQL Server 2016 SP 1 and Always Encrypted support was added as data-at-rest encryption approach. Encryption can be configured just for columns with sensitive data. The performance for all other data will not be affected.

Both, SQL Server and SQL Provider has to be configured to support Always Encrypted.

Below you can find required encryption type per column with sensitive data.

enter image description here

It's also required to enable always encrypted in the sc.Xdb.Collection.Data.Sql.xml configuration file in all the roles:


It's optional feature. As far as, Sitecore 9 uses sharded clusters with multiple shards, all the shards have to be configured individually. If you need more details, I can provide them. TDE can be configured as well. There is no official documentation that states that TDE is supported, but all the databases in PaaS are deployed with TDE enabled by default. Always Encrypted can be configured just for the 'collection' db. All other dbs do not support it.


The final answer from support:

You can enable Transparent Data Encryption (TDE) on your SQL Server and there is no limitation to do it because SQL Server Transparent Data Encryption does not affect "Sitecore - SQL Server" communication. It affects how SQL Server stores data in the encrypted database. Sitecore uses standard .NET techniques to communicate to SQL server (it utilizes SqlConnection .NET Framework class), therefore, all changes to "Sitecore - SQL Server" communication which are transparent for .NET SQL connection are transparent for the Sitecore application.

You should also pay attention that even after you have SQL server configured to encrypt the content of the database communication between SQL server and Sitecore application will be still unencrypted.


If you are referring to always encrypted feature which is provided by Sql Server, then short answer is: no, at the moment there is no official Sitecore documentation on how to enable the feature in Sitecore 9. However, considering that doc site for Sitecore 9 is constantly updated, I would expect the documentation to be published in not too distant future.

What is known so far is that Always Encrypted is an optional feature which needs to be explicitly configured. It can be enabled just for columns that contain sensitive data (e.g. contact identifiers, facet data). Column master key can be stored in either Windows Certificate store (for on-premise deployments) or Azure Key Vault.

  • The question actually stemmed from an IT question on the specific technology used for that encryption. As that would apparently impact server configurations/choices... I'm going to open up a Sitecore ticket on this and get back to you all Commented Dec 11, 2017 at 19:43
  • 1
    What Sitecore 9 uses for data at rest (stale data) encryption is a standard SQL 2016 feature called Always Encrypted: docs.microsoft.com/en-us/sql/relational-databases/security/…. However, if you get more information from Sitecore, please do share with us.
    – grg
    Commented Dec 12, 2017 at 8:33
  • @grg what are the areas where Sitecore 9 uses "Always Encrypted"? I checked facets marked as PIISensitive and they are stored in [xdb_collection].[ContactFacets] table unencrypted. But maybe I miss something?
    – whuu
    Commented Apr 20, 2018 at 9:03
  • 1
    @whuu, by "Always Encrypted" I meant SQL Server feature which is not related to PIISenstive. The feature allows individual columns to be encrypted (e.g. column containing facet data). However, there is no available Sitecore documentation yet on how it can be achieved in xConnect. Official doc on Sql Server Always Encrypted: docs.microsoft.com/en-us/sql/relational-databases/security/…
    – grg
    Commented Apr 30, 2018 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.