> Explore Qdrant's agent skills catalog at https://skills.qdrant.tech/
> Search the documentation at https://skills.qdrant.tech/search?query=your+query+here
> Use this file to discover all available pages: https://qdrant.tech/llms.txt
# Encryption at Rest

Qdrant Managed Cloud encrypts all storage volumes at rest by default. [Premium customers](https://qdrant.tech/documentation/cloud-premium/index.md) can also use their own cloud key management service (KMS) key for additional control over their encryption. Enabling this requires opening a support ticket. Qdrant Support provides the cloud-specific identifiers and detailed setup instructions, then configures your cluster once your key is in place.

## Prerequisites

- A [Premium Managed Cloud](https://qdrant.tech/documentation/cloud-premium/index.md) subscription
- An existing cluster in Qdrant Cloud (create one before requesting encryption)
- Whether your cluster is empty or contains data. We recommend starting with an empty cluster where possible.

## Step 1: Open a Support Ticket

Open a support ticket via the [Qdrant Cloud Console](https://cloud.qdrant.io/) and include:

- Your cluster ID
- Your cloud provider (AWS, GCP, or Azure)
- Whether the cluster is empty or contains data

Qdrant Support will respond with the cloud-specific identifier you need to complete the next step:

- **AWS**: Qdrant's AWS account ID
- **GCP**: Qdrant's Compute Engine service agent email
- **Azure**: Qdrant's Entra application ID (client ID)

Support will also provide detailed setup instructions.

## Step 2: Create Your Encryption Key

Follow the instructions from Qdrant Support to complete the key setup for your cloud provider.

### AWS

In AWS KMS, create a symmetric key in the same region as your cluster and grant Qdrant's account access to it using the identifier provided by Support. Copy the resulting **Key ARN**.

### GCP

In Cloud KMS, create a key ring and symmetric encrypt/decrypt key in the same region as your cluster and grant Qdrant's service agent access to it using the identifier provided by Support. Copy the resulting **Key ID**.

### Azure

Install Qdrant's Entra application into your Azure tenant using the application ID provided by Support, create a Key Vault with an encryption key in the same region as your cluster, and grant Qdrant's service principal access to it. Copy the resulting **Key URL**.

## Step 3: Reply to the Support Ticket

Send Qdrant Support your key identifier:

- **AWS**: Key ARN
- **GCP**: Key ID
- **Azure**: Key URL

Qdrant Support will configure encryption for your cluster.