Knowledge Base Article Applies to: NX / ZX series NAS (NX2, ZX, NX3, ZX3), software release up33 and later Last reviewed: August 2026
Summary
Scale Logic NX and ZX storage systems protect customer data in two independent ways: encryption at rest, which protects the data physically stored on the drives, and encryption in transit, which protects data as it moves between client workstations and the NAS. The two work at different layers and are complementary — together they provide defense in depth for a media or file workflow.
Encryption at Rest
Encryption at rest protects the data physically written to the storage media. Its purpose is to guard against the theft or loss of a physical drive or an entire chassis: if a disk leaves the facility, the data on it is cryptographically scrambled and cannot be read, re-hashed, or reconstructed in another system.
Beginning with software release up33, the NX and ZX platforms provide software-based encryption at rest using 256-bit AES, integrated directly into the ZFS file system. Encryption is applied to the storage pool by the system software itself — no self-encrypting drives and no dedicated encryption cards are required. This keeps deployments simple, avoids dependence on specialized hardware, and works with the standard drives shipped in the NX and ZX platforms.
How it works, at a high level:
Encryption is enabled on the storage pool, and the customer supplies a strong passphrase (key) that controls access to the encrypted data.
The system encrypts data as it is written and decrypts it as it is read, transparently to client applications. Modern server processors include built-in AES acceleration (AES-NI), which the software uses to keep the performance impact low.
If a drive or an entire chassis is physically removed or stolen, the data on it is cryptographically scrambled and cannot be read, re-hashed, or reconstructed without the key.
Key ownership. The encryption passphrase is the customer's property. Scale Logic does not retain or store customer encryption keys. Customers are strongly advised to record the passphrase and their saved system configuration in a secure location (for example, with the company's CEO, CTO, or controller), as the key is required to recover an encrypted pool after certain failure conditions.
A note on FIPS. Scale Logic's software encryption uses 256-bit AES. It is not, by itself, a FIPS 140-2 validated configuration, which some government and research environments specifically require. If a deployment has a FIPS requirement, please raise it with Scale Logic so it can be addressed at the design stage.