The Directory Server provides an encryption-settings database that holds encryption and decryption definitions to protect sensitive data. You can enable on-disk encryption for data:

  • in backends
  • in the changelog
  • in the replication databases

You can protect sensitive attributes by limiting the ways that clients can interact with them.