What is server-side encryption?

Server-side encryption is encryption performed by the service that receives and stores your data: it encrypts the data as it writes it to storage and decrypts it again when an authorized request reads it, so the data is unreadable on disk but readable to the service itself.

How it works

AWS's definition for S3 is the standard one: "Server-side encryption is the encryption of data at its destination by the application or service that receives it." S3 "encrypts your data at the object level as it writes it to disks in AWS data centers and decrypts it for you when you access it", and "as long as you authenticate your request and you have access permissions, there is no difference in the way you access encrypted or unencrypted objects" (Amazon S3).

That last sentence is the key to the model. Encryption is invisible to anyone the service lets in. It protects against people who get at the storage without going through the service.

S3 offers several variants, which differ in who manages the key: S3-managed keys (the default for every bucket), keys in AWS KMS including customer-managed keys, dual-layer encryption with KMS, and keys you provide with each request. In every case, S3 performs the encryption and decryption.

What it protects against

• Stolen or improperly disposed disks.
• Someone reading raw storage or backups outside the service.
• Some insider access, where staff can reach storage but not keys.

What it doesn't protect against

• The service itself. It holds or can call for the key, by design.
• Anyone the service authorizes. A leaked access key with read permission gets plaintext.
• A compromised server or application. Code running in the service sees decrypted data.

Secret managers built on this model, such as cloud secret stores, decrypt values for callers their policies allow. AWS Secrets Manager says it "decrypts the secret value before returning it to the caller" (AWS Secrets Manager). That is what makes server-side features possible: syncing values to other systems, generating credentials, rotating at providers.

Server-side versus client-side

Common mistakes

• Taking "encrypted" as "private from the vendor". Server-side encryption usually isn't.
• Ignoring access policies because data is "encrypted anyway".
• Forgetting metadata. Names, tags and descriptions are often stored in plain form.

Where Crunu stands

Crunu uses client-side encryption for values, not server-side. Encryption and decryption happen only in the browser and in the crunu agent; the server receives ciphertext and environment keys sealed to recipients' public keys, and has no key that decrypts them at any point in the protocol. A stolen database or a compromised server yields no values.

The price is real: no server-run syncs, dynamic secrets or rotation at providers. And the server still sees metadata. The full comparison is in who can decrypt your secrets?.

Sources

• Amazon S3: Protecting data with server-side encryption, checked October 30, 2026.
• AWS Secrets Manager: Secret encryption and decryption, checked October 30, 2026.