Encryption of data at rest in Azure

Data at rest includes information that resides in persistent storage on physical media, in any digital format. The media can include files on magnetic or optical media, archived data, and data backups. Microsoft Azure offers a variety of data storage solutions to meet different needs, including file, disk, blob, and table storage. Microsoft also provides encryption to protect Azure SQL Database, Azure Cosmos DB, and Azure Data Lake.

Data encryption at rest is available for services across the software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS) cloud models. For a more detailed discussion of how data at rest is encrypted in Azure, see Azure Data Encryption-at-Rest.

Encryption of data in transit to/from Azure

Azure offers many mechanisms for keeping data private as it moves from one location to another, Syncrony primarily uses TLS/SSL encryption for data in transit

Microsoft uses the Transport Layer Security (TLS) protocol to protect data when it’s traveling between the cloud services and customers. Microsoft datacenters negotiate a TLS connection with client systems that connect to Azure services. TLS provides strong authentication, message privacy, and integrity (enabling detection of message tampering, interception, and forgery), interoperability, algorithm flexibility, and ease of deployment and use.

Syncrony Security within Azure

Syncrony primarily uses two services to store data in Azure: Azure SQL databases for relational data and Azure Storage Accounts for flat files and exports.

Azure SQL Databases

Syncrony utilizes the Transparent Data Encryption service through Azure. TDE is used to encrypt SQL Server, Azure SQL Database, and Azure SQL Data Warehouse data files in real time, using a Database Encryption Key (DEK), which is stored in the database boot record for availability during recovery.

TDE protects data and log files, using AES and Triple Data Encryption Standard (3DES) encryption algorithms. Encryption of the database file is performed at the page level. The pages in an encrypted database are encrypted before they are written to disk and are decrypted when they’re read into memory. TDE is now enabled by default on newly created Azure SQL databases.

In addition, Syncrony takes advantage of Advanced Data Security for Azure SQL Databases offering which provides Data Discovery & Classification, Vulnerability Assessment, and Advanced Threat Protection.

Azure Storage Accounts

Azure Storage service encryption protects your data at rest. Azure Storage encrypts your data as it's written in our datacenters, and automatically decrypts it for you as you access it. Additionally, all access to data within Syncrony’s Azure storage account must be accessed with a Shared Access Signature.

Last Updated: Sep 2019

Browser not supported