Skip to main content
Domino encrypts data both in transit within the cluster and at rest, using a mix of platform defaults and cloud-provider-managed encryption.

​
Encryption in transit

​
Domino web application

Domino serves its web application and API over HTTPS and terminates TLS at the ingress load balancer, using an SSL certificate applied to the load balancer and an NGINX ingress that enforces TLSv1.2 and TLSv1.3 with a FIPS-validated OpenSSL build.

​
Intra-cluster communication

Intra-cluster encryption in transit is implemented, if enabled, through a deployed service mesh called Istio. At installation, Domino can deploy Istio for Domino use only, or you can configure Domino to use an existing Istio mesh on the Kubernetes cluster. See Control plane security and Work with CA certificates for configuration details.

​
Encryption at rest

​
Project files

Domino supports server-side encryption with customer-provided keys (SSE-C) for Amazon S3, and EBS file system encryption using the AES-256 algorithm on Elastic Block Store. Domino also supports default encryption keys for Amazon S3, Azure File Storage, and Google Cloud Filestore. Domino does not provide pre-write encryption for nfs-client-provisioner volumes. See Manage Project file storage for details.

​
Secrets

Domino stores secrets in an instance of HashiCorp Vault. By default, Vault stores the following secrets encrypted at rest without additional configuration:
  • User environment variables
  • User API keys
  • Data Source access secrets
  • Project environment variables
Last modified on August 11, 2026

Related topics

Security at DominoShare Data Sources securelyControl plane securityManage Project file storage