# Encryption

Altertable encrypts customer data in transit and at rest. See [Security and compliance](/security-compliance) for the security overview, key-management information, and SOC 2 Type II attestation.

## Credentials

Database and object-storage credentials are encrypted before storage and used when Altertable connects to the source. Use [lakehouse credentials](/docs/administration/lakehouse-credentials.md) for clients that query or ingest through Altertable.

Encryption protects stored credentials, but it does not determine what the credential holder can access. Use [access control](/docs/administration/access-control.md) to scope members and service accounts.

## Lakehouse storage

Altertable-managed storage uses Cloudflare R2 and Amazon S3, with encryption keys managed by Altertable. If you connect your own bucket, review that provider’s encryption and key-management settings alongside its access policy.

Workers write to distributed object storage buckets over TLS 1.3. Each bucket stores data encrypted at rest with AES-256 and Altertable-managed keys.

See [Buckets](/docs/lakehouse/storage/buckets.md) for managed and connected storage options, and [Network access](/docs/administration/network.md) for reaching restricted sources.

To query Amazon S3 table buckets, connect an [S3 Tables external catalog](/docs/lakehouse/external-catalogs/s3-tables.md).