# \[RELEASE\] ScyllaDB Cloud – Database-level Encryption on GCP (GA)

**URL:** <https://forum.scylladb.com/t/release-scylladb-cloud-database-level-encryption-on-gcp-ga/5281>\
**Category:** ScyllaDB\
**Tags:** cloud, cloud-release\
**Created:** [February 17, 2026, 9:10am UTC](https://forum.scylladb.com/t/release-scylladb-cloud-database-level-encryption-on-gcp-ga/5281 "2026-02-17T09:10:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Buff](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.scylladb.com/buff/32/1948_2.png) [@Buff](https://forum.scylladb.com/u/Buff)\
**Post date:** [February 17, 2026, 9:10am UTC](https://forum.scylladb.com/t/release-scylladb-cloud-database-level-encryption-on-gcp-ga/5281/1 "2026-02-17T09:10:54Z")

</div>

![image](https://us1.discourse-cdn.com/flex016/uploads/scylladb/original/2X/b/bbed39608b65e02ae551e11cb4813035b15f3941.png)

Hello,  
The ScyllaDB Cloud team is pleased to announce that database-level encryption is now generally available, and **enabled by default for all new ScyllaDB Cloud clusters on Google Cloud** , including **BYOA deployments**.

This release introduces encryption at the **database engine layer** , ensuring that data is protected well beyond the underlying cloud storage encryption.

### Transparent to applications and drivers

No performance tuning or operational changes are required; the database-level encryption is transparent for the users.

### What database-level encryption protects

All data is encrypted **before being written to disk** , including:

- SSTables
- Commit logs
- Hints
- CDC logs (if enabled)
- System tables that may contain user data

This ensures the data remains unreadable even in case:

- Raw disks are accessed
- Snapshots are copied
- Volumes are detached or exposed

### Key management model

ScyllaDB Cloud uses **envelope encryption** with either **Customer-managed keys (CMEK)** via Google Cloud KMS  
The keys can be managed by the customer or by ScyllaDB on the customer’s behalf.  
This provides **strict separation of duties** between the key management and data management

### Compliance alignment

This feature helps customers meet encryption-at-rest requirements, ensuring all PII data is unreadable without the key.  
Many compliance standards require database-level encryption.  
Including but not limited to:

- PCI DSS
- HIPAA
- ISO 27001
- SOC 2

Database-level encryption is now the **standard security baseline in ScyllaDB Cloud** , delivering stronger data protection, simplified compliance, and seamless operation for both hosted and BYOA environments.

You can read more about the encryption process here:  
[ScyllaDB Cloud Documentation](https://cloud.docs.scylladb.com/stable/security/database-level-encryption.html)  
[Getting Started with Database-Level Encryption](https://www.scylladb.com/2026/02/16/getting-started-with-database-level-encryption-at-rest-in-scylladb-cloud/)