# Apply Backup Encryption

By default, the <code class="expression">space.vars.backup\_service</code> uses AES-256 server-side encryption for storage devices, preventing unauthorized access outside the server. This document describes how to apply client-side AES-256 encryption to a protection plan using a password.

{% hint style="info" %}
**Prerequisites:**

* Make sure that your browser allows popups.
* Only contract administrators, owners, or users with the **Create Backup Units** privilege can manage Backup Units.
  {% endhint %}

## Open the Backup Service Console

1\. In the **DCD**, go to **Menu** > **Storage & Backup** > **Backup Unit Manager**.

2\. Select the required backup unit and click **Open Console**.

![Open Backup Service Console](https://1737632334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MifAzdGvKLDTtvJP8sm%2Fuploads%2Fgit-blob-3b4c594754872c505d2336964e4b5fe134c05528%2Fmenu_backup_console.png?alt=media)

## Encrypt backups

Backup encryption can be enabled only during creation of the new protection plan.

1. Navigate to **MANAGEMENT** > **Protection plans**.
2. Click on the **+ Create Plan** in the right pan.
3. Click on the **Specify password** link in the **Encryption** section.

![Enable Specify password in the Encryption section](https://1737632334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MifAzdGvKLDTtvJP8sm%2Fuploads%2Fgit-blob-26ed2ee5ee5078a9ad79d446f100c09507f75cac%2Fcreate_protection_plan.png?alt=media)

4. Enter a strong encryption password and confirm it to ensure there are no typos. Make sure to store this password securely, as it will be required to restore the backups.
5. Configure any additional settings for your protection plan.
6. Assign this protection plan to your devices.

{% hint style="success" %}
**Result:** The backups are encrypted with the specified password, ensuring that the data is secure and can only be restored using this password.
{% endhint %}

{% hint style="warning" %}
**Note:** Backup agents on your devices encrypt data locally before sending it to the <code class="expression">space.vars.backup\_service</code>. If you lose your encryption password, you cannot restore your data. Store this password securely.
{% endhint %}