Envoy uses Heroku Encrypted Postgres (AES-256 disk encryption). Private TLS keys are managed by Cloudflare; disk encryption keys for data at rest are managed by Heroku and AWS; application encryption keys are managed by Heroku with restricted access for required Envoy employees.