What the extra encryption protects#
Advanced Data Protection adds another encryption layer to your team's stored document content. It helps protect that content if stored file data is exposed without the separate keys needed to decrypt it. Every plan, including Free, already uses encryption in transit and at rest; this extra layer is available on paid plans.
It covers document bodies, retained versions and supported content files. The service generates a fresh random key for each newly encrypted content item or version, using AES-256-GCM. Team keys protect those content keys, and service root keys protect the team keys. Markdown Logic manages all of these keys. Passwords, passkeys and recovery codes establish account identity; they are not encryption keys you must keep or supply.
Understand the limits#
Authorized service components decrypt and process content for viewing, editing, conversion, permitted sharing and exports. This is not end-to-end encryption or customer-managed encryption. It does not prevent the running service or an authorized recipient from seeing plaintext, or protect against a compromise of the trusted service and its access controls.
Properties, filenames and ordinary metadata remain outside this added layer. An enabled search index is also outside it. These data continue to use the service's standard storage protections.
Earlier infrastructure backups may remain in their original storage form. Exports, downloads and recipient copies are outside the conversion and are not recalled. Enabling protection, rotating keys or deleting a document does not guarantee immediate erasure of every earlier copy.
Enable protection#
As a team owner or administrator:
Before selecting Enable, review Automatically rotate this team’s wrapping key every 90 days when offered. It starts selected if no earlier setting exists; an existing On or Off choice is kept. Leaving it selected grants continuing permission in the same passkey approval, until you turn it off. You can clear it before approving.
- Open Team → Settings → Data Protection.
- Choose Enable advanced data protection and authenticate if prompted.
- If you do not have a passkey, choose Create a passkey when offered during initial setup.
- Choose On or Off for search indexing, then select Enable. Verify your passkey in the browser prompt to approve the change.
You can keep working while encryption changes in the background.
Once accepted, the task continues in the background even if you leave the page or sign out. A long conversion does not require repeated approval. Revoking access or recovering an account can pause a task to protect it; follow the next step shown in Settings.
Choose search indexing#
On enables content search by allowing content to be processed into a separate search index. That index does not receive the additional Advanced Data Protection encryption. Off disables content search and avoids that indexed copy. Choose the option that suits your team.
To change the choice while protection is on, select Manage search indexing, choose On or Off, then Save or renew indexing and verify your passkey. Removing or rebuilding an index may take time. A short waiting period between changes prevents rapid switching; the controls become available when another change is allowed.
Rotate team encryption keys#
Choose Key rotation settings to open the rotation page, including when protection is off, conversion is paused or your plan has changed. Starting a new rotation still requires protection to be fully on and the team to be eligible for a paid plan. To start one rotation, choose Rotate wrapping key and confirm with your passkey.
For recurring rotation, select Automatically rotate this team’s wrapping key every 90 days, choose Save automatic rotation and confirm with your passkey. Teams already using protection must approve this once; opening the page grants no permission. The page shows the current setting, last successful rotation and next scheduled date. The first interval starts at approval; each successful manual or automatic rotation starts a new 90-day interval.
You can turn the setting off with passkey confirmation to stop new automatic starts. Accepted work finishes even after you turn it off, disable protection or sign out. The setting remains saved when protection is disabled; new starts wait until protection is fully on and the team is eligible for a paid plan. Conversion pauses new starts. Returning after a missed date starts one rotation, without accumulated catch-up rotations.
New writes use the new wrapping key immediately. Existing content keys are rewrapped in bounded background batches, aiming for about a week. Small teams may finish sooner; backlogs or failures can take longer. This is not a deadline for deleting old keys. Required old keys, wrapping history and backups remain retained. Replacement stored envelopes include unchanged encrypted content, so repeated rotations use additional storage and I/O, not just metadata updates.
Current documents, retained versions, original receipts and permitted shares remain usable. Rotation does not undo access to copies or keys that were already disclosed. If work is revoked, may already have begun or has an unknown outcome, follow the displayed guidance and contact support for reconciliation; switching the setting off and on alone may not resolve it.
Choose optional account safeguards#
Account safeguards are a separate, optional choice. They can apply with encryption on or off and remain selected after encryption is disabled. Review the Account safeguards tab; enabling or disabling encryption does not remove an existing selection.
If you select these safeguards, save any recovery codes offered and follow the account recovery instructions if you lose access. The recovery page shows any security hold and when sensitive changes can resume. Account recovery restores authorized access; it does not recover or replace the service's encryption keys.
These optional safeguards currently require each member to belong only to this team and have verified sign-in credentials. Members with older accounts may need to sign in again normally first. Encryption is independent and does not require these safeguards or extra setup by every member. Contact support for unresolved issues with an account’s earlier protected state; affected accounts are not repaired automatically.
Resume conversion after account recovery#
Ordinary logout or a long conversion does not require another approval. If a security or permission change pauses conversion, follow the guidance in Settings. Use Resume document conversion when it is offered and follow its verification instructions.
Disable protection or change plans#
Choose Disable advanced data protection, read the confirmation, then select Confirm with passkey. You can keep working while encryption changes in the background. Account safeguards are optional, work with encryption on or off, and remain selected when encryption is disabled.
Moving between paid plans preserves protection. Before moving to Free, complete the authorized disable process and wait for conversion to finish.
Sensitive protection changes are recorded for audit. Use Settings to confirm progress and completion. If progress is paused or status cannot be loaded, follow the displayed guidance or Try again; do not start a conflicting change.