Vector indexes of sensitive case notes must remain protected while stored. Which control best addresses that risk?

Encrypting the vector indexes at rest in the city's managed store is the control that protects sensitive case-note embeddings while stored. Embeddings and vector indexes derived from case notes remain sensitive municipal data; encryption at rest reduces confidentiality impact if disks, snapshots, or backups are accessed offline or stolen. Managed-store encryption with proper key management is the standard storage control for civic RAG corpora of this type.

Encrypting the vector query cache at rest in the city's managed store fails by scope because protecting only the cached queries does nothing for the plaintext primary vector indexes sitting on disk that the stem asks about. Encrypting the vector index backups at rest in the city's managed store fails by scope because protecting only the backup copies leaves the live primary indexes readable in plaintext if the managed store is accessed. Encrypting the vector indexes at rest in the local application cache fails by location because protecting only the local copy leaves the primary indexes in the city's managed store readable in plaintext if that store is accessed.

Exam caveat: Treat vector indexes of sensitive content as sensitive data at rest, end to end: the live store, its backups, and its keys. Encrypting only the query cache, only the backups, or only the local application cache each leave the primary plaintext copy in the managed store unprotected.

Operational check: Enable encryption at rest on the case-note vector indexes in the managed store, verify keys are managed and rotated by the city KMS/HSM process, confirm the primary store (not just backups) is encrypted, and re-test retrieval after encryption is on.