For a system like ES there is encryption in transit and encryption at rest. https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-

For a system like ES there is encryption in transit and encryption at rest. https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html https://docs.aws.amazon.com/elasticsearch-service/latest/dev... amazon elastic search gives you the option of encrypting the data at rest (meaning it is encrypted by amazon ES when stored persistently) - they use KMS for key management, so it should have a per record symmetric key that is encrypted by master symmetric key. It's notable that the amazon fork has added this functionality, this does not seem to be part of elastic search proper (please correct me if I am wrong) Elastic search proper is only talking about encryption in transit https://www.elastic.co/what-is/elastic-stack-security?ultron=B-Stack-Trials-EMEA-Other-UK-Exact&gambit=Security-Elastic-Security&blade=adwords-s&hulk=cpc&Device=c&thor=elasticsearch%20encryption&gclid=CjwKCAjw3_KIBhA2EiwAaAAlii_hMSFyQZb8bikIOPqZV_vAakNhaFiM9D6JosZgt62eDBAyODFLvBoCXMYQAvD_BwE https://www.elastic.co/what-is/elastic-stack-security?ultron... Here they say that they don't have encryption at rest https://www.elastic.co/guide/en/cloud-enterprise/current/ece-securing-considerations.html https://www.elastic.co/guide/en/cloud-enterprise/current/ece... Now you can possibly encrypt the records at the application level, but that makes them unsearchable; however the ability to search the stuff is arguably the point of having it in elasticserarch.