Vultr DBaaS encrypts databases and backups at rest with strong keys, LUKS2, AES-256, and RSA.
All Vultr Managed Databases instances are encrypted at rest. Each service instance and its underlying virtual machines use full volume encryption with unique, randomly generated ephemeral keys. These keys are never reused and are securely destroyed when the instance is terminated, providing natural key rotation. Vultr uses strong industry-standard encryption (LUKS2 with aes-xts-plain64:sha256 and a 512-bit key). Backups are also encrypted with per-file keys using AES-256 in CTR mode and HMAC-SHA256 for integrity protection. Keys are further wrapped with a 3072-bit RSA key pair generated for each service, and encrypted backup files are stored in the same region as the database service.