Your Backups, Encrypted Before They Ever Leave for the Cloud
Rubrik, Tuesday, August 25th, 2026
Rubrik adds client-side encryption to Cloud Native Protection, encrypting backups before they reach object storage.
Rubrik has introduced client-side encryption for Cloud Native Protection, encrypting backups before they ever leave for storage using keys the customer controls.
The post explains why the location of encryption matters more than it sounds: with server-side encryption, backups travel to the storage location and are encrypted once they arrive, which is the model Cloud Native Protection has supported for years and which works well for many teams.
Client-side encryption moves that boundary of trust to the customer's own environment. The article is a deep dive into envelope encryption, Rubrik UEM and the four-level key hierarchy, covering the backup flow, the recovery flow and how the keys themselves are protected.