What is encryption at rest?

The threat it addresses is physical or storage-level. A stolen drive, a discarded server, a backup file copied out of a bucket.

It is close to universal now, because cloud providers offer it as a default rather than a feature.

The key management is the part that varies and the part nobody asks about. Keys stored beside the data protect against a stolen disk and very little else.

It does nothing about the far more common attack. Stolen credentials produce a legitimate login, and the system happily decrypts everything for that session.

Say your office manager keeps call exports on a laptop, and it's stolen from her car. With full-disk encryption switched on, which means FileVault on a Mac or BitLocker on Windows, the thief has a locked brick. Every file is scrambled with a key that only exists after she logs in. You'd replace the laptop and move on.

Now change one detail so that nobody steals the laptop. Someone guesses her email password instead, which she reused from a shopping site, and signs in to your cloud phone dashboard from another country. Each record in that dashboard is encrypted at rest with AES-256, and it makes no difference. The system sees a valid login and decrypts every page as it's asked for. You have the same data and the same encryption in both stories, with opposite endings. A second login factor is what stops the second one.

Vendors look after the server side, but copies of your records live on devices you own. On each Mac, open System Settings, then Privacy and Security, and look for FileVault. Windows users can search for BitLocker or Device encryption. Phones made in the last several years encrypt their storage once a passcode is set, so your check there is simply whether everyone has one.

Look at your backups next. An external drive in a desk drawer holding three years of exports is the classic gap, because nobody thinks of it as a computer. You should encrypt it or empty it.

For vendors, two questions are enough. Ask whether backups are encrypted along with the live database, and ask who at the company can use the keys. "Only an automated service, and every use is logged" is a good answer. "Our engineers can if they need to" is at least an honest one, and you can decide what to store with that in mind.

GreetKeeper holds no certifications, so the honest description is that we use standard hosting protections rather than an audited control set.

The controls that do most for your call records are the ones you set: retention length, who has access, and whether recordings are kept at all.

If your review requires an audited attestation, that is a real reason to choose an established vendor today, and we would rather say so than imply we have one.