Help center

By default, document files in OVH Object Storage are protected by OVH platform encryption at rest. Enterprise organizations can additionally enable per-document envelope encryption under Settings → Organization.

When enabled, each new document gets its own data encryption key (DEK). File bytes written to object storage (original upload, converted PDF, redacted output, native Office output) are encrypted with AES-256-GCM before storage. The DEK is wrapped with a platform-managed per-organization key encryption key (org KEK), which is itself wrapped by a platform root key (or, with Azure Key Vault BYOK, by your customer-managed key). Keys are stored separately from the file.

What is encrypted: document objects in storage for that organization after the setting is turned on. What is not encrypted by this feature: detection rows, page text, and other metadata in the application database (needed for search and review). Watermark images, signed agreements, and short-lived support copies are also outside this path.

Existing documents uploaded before you enable the setting stay as they were stored. Turning the setting off stops encrypting new uploads; documents that already have a key remain encrypted and continue to decrypt normally for processing and download.

Processing still needs cleartext in memory: the app server and PDF engine decrypt to convert, OCR, detect, redact, and verify, then encrypt again when writing results back to storage. Content hashes (SHA-256) are computed on plaintext so verification stays meaningful.

Support access: if your team shares a file with Northdocs support for a ticket, we decrypt the customer object and store a short-lived plaintext copy under a support-scoped path tied to that ticket.

Requirements: Enterprise plan (or an admin plan grant that includes the envelope_encryption entitlement). Organization admins toggle the setting; only enabling it is plan-gated, you can turn it off at any time.

Optional: wrap the organization key with your own Azure Key Vault CMK. See the Azure Key Vault BYOK article.

Organization key rotation: under Settings → Organization, admins can Rotate organization key. That mints a new org key, re-wraps per-document keys in batches (large orgs finish via a daily job), and retires the old org key. Document file bytes in object storage are not rewritten.

See also the Security overview and GDPR & retention article for residency, retention, and the broader control set.