A city stores RAG embeddings of resident complaints for a 311 assistant. Which data management control best protects that corpus?

A 311 RAG corpus of resident-complaint embeddings remains sensitive even after vectorization. Embeddings can leak topics, locations, and personally identifiable patterns through inversion, membership inference, or unauthorized store access. Encrypting embeddings at rest and in transit with managed keys treats the vector database as a protected civic data store, aligning confidentiality controls with the underlying complaint content. Encrypting the embeddings at rest with managed keys for stored indexes protects only the stored layer and leaves queries and retrieval traffic unencrypted in transit, so it fails to protect resident-complaint vectors moving between the store and the 311 assistant. Encrypting the embeddings in transit with managed keys for queries protects only the wire and leaves the stored corpus unencrypted at rest, so anyone who reaches the disk, backup, or snapshot layer can still read the vectors. Encrypting the embeddings at rest and in transit with hardcoded keys covers both states but violates the managed-key requirement, since hardcoded keys cannot be rotated, audited, or access-controlled and can be extracted from code or images to decrypt the corpus. Exam caveat: AAISM data management for AI corpora applies classical confidentiality controls to derived artifacts such as embeddings, not only to raw source text. Operational check: place the 311 vector store behind managed encryption (KMS/HSM-backed keys), enforce TLS, restrict keys and roles by least privilege, and verify that backup and export paths inherit the same classification and encryption requirements.