# Encrypt the Mac, the connection and the backup. Where your files are locked, where they are not, and what a client review asks. > Where your files are locked and where they are not: FileVault on the Mac, TLS on the way, the key holder in the cloud and the backup disk. Check each one. Page: https://cybee.ai/blog/cloud-data-encryption/ (Data encryption: Mac, connection, cloud and backups) - [Blog](https://cybee.ai/blog/) - Data encryption mac security Someone who finds a lost laptop, listens in on a café network or picks up an old backup disk can read your files, unless a lock stands in the way. Each of those three places has its own lock, and each lock has a key that somebody has to keep. Here is what to check in each place, and what you can tell a client who asks. By [Cybee](https://cybee.ai/about/#founders) Published 28.10.2026 10 minute read In one minute - Your files sit in three places: on the Mac, on the way to a service, and in the cloud and in backups. Each place has a different lock. - On the Mac the lock is FileVault. You can see in System Settings, under Privacy & Security, whether it is on. - On the way, the lock is a secure connection that your browser and most tools already use. Check that none of your tools skips it. - In the cloud and in backups, the question is who holds the key. Ask each provider, and encrypt the backup disk yourself. - Keep a recovery key away from the Mac it opens, and change the keys a client gave you when the project ends. ## Three places your data sits. Encryption scrambles a file so that nobody can read it without the right key. The scrambling is rarely the hard part. The hard part is that every place your data sits has its own lock, set by a different company or a different setting, and nobody tells you when one of them is open. Your files rest on the Mac. They travel from the Mac to a service and back. And copies wait in the cloud and in backups, on machines you do not own or on a disk in a drawer. A Mac with its lock on says nothing about the other two places. Figure: Three places, three locks. Each one is checked on its own. ## On the Mac, switch on FileVault. FileVault is the Mac’s own disk encryption. With it on, the files on the startup disk can be read only after someone enters your login password or the recovery key. A lost or stolen laptop then holds scrambled data, not your client’s files. Every Mac with an Apple chip already encrypts its internal disk. Apple’s security guide says what FileVault adds. With it off, only the chip inside the Mac guards the key, so the Mac can open its own disk without your password. With it on, your password guards the key too. Macs with Apple’s T2 security chip do the same. On older Macs without one, nothing is encrypted until you switch FileVault on. You can check this Mac by Mac in a few clicks. If you look after several, write down which Macs you looked at and on what date, because that is the answer a client wants. 1 2 3 Figure: Where FileVault lives, in the order the settings appear. ## On the way, use a connection nobody can read. When you open a web address that starts with https, or upload a file to a client’s portal, your Mac and the service agree on a key and scramble everything between them. The technology behind it is called TLS. The standard that defines it describes its job as a secure channel between two parties. Nobody in the middle can read what passes. Nobody can change it without being noticed. And the service proves who it is with a certificate, so an impostor cannot pose as it. For most work, this is already done. Browsers, email programs and cloud tools use it without being asked. What is left for you is the exceptions. An old file transfer tool or a script may still send client files over a plain connection. A login page whose address starts with http, without the s, sends your password in the clear. A café or hotel network may show a warning that the connection is not private. Stop at that warning rather than clicking through. TLS only protects the trip. Once the file arrives, the service holds it, and what happens next is the third place. **Q:** What does TLS mean? ### What TLS means. TLS stands for Transport Layer Security. It is the standard way two programs on the internet set up a private, tamper evident connection. You meet it as https at the start of a web address. It protects data while it moves. It says nothing about how the receiving service stores the data afterwards. ## In the cloud and in backups, ask who holds the key. A good cloud service encrypts what it stores. The UK National Cyber Security Centre says providers should encrypt all customer data at rest within the service. That is guidance for providers, not a promise from any one of them, so the useful question is not whether your files are encrypted. It is who can read them. iCloud shows the difference. By default, Apple keeps the keys for iCloud Drive and iCloud Backup, among others, which is why Apple can restore your access after you forget your password. If you turn on Advanced Data Protection, your trusted devices hold the keys instead. More categories become end to end encrypted, which means only your own devices can read them, and Apple cannot get your data back for you if you lose access. Apple makes you set up a recovery contact or a recovery key first. Neither setting is wrong. One favours recovery, the other privacy. Choose on purpose and write down which you chose, so that a client who asks “who can read our files?” gets an answer and not a shrug. The NCSC is clear about the split: you keep responsibility for configuring the services you pick securely and for deciding which data goes into them. Encryption does not stop a signed in person A lock keeps out people who lack the key. Someone signed in to your account, or holding a shared link, is treated by the service as you. Strong sign in and careful sharing are separate checks. Backups are where people forget. A Time Machine disk in a drawer holds every file your Mac held, and anyone who picks it up can read it unless it is encrypted. Apple calls encrypting the backup disk the best way to keep backups secure. In Finder, Control click the disk, choose Encrypt, then set a password and a hint. You can also choose encryption when you set up the disk in System Settings, under General and Time Machine. A network backup disk that you switch to encrypted loses its existing backups and starts again. To restore files from an encrypted backup you must give the backup password, and Apple says nobody but you should have it. Keep it wherever you keep your recovery keys. ## Keep the keys apart from the locks. Encryption moves the risk from the data to the key. That is a good trade only if you look after the key. A few habits cover most small teams. - Keep the FileVault recovery key away from the Mac it opens. Apple says to store a copy somewhere other than the encrypted startup disk. Your team’s password manager, or a printout in a locked drawer, works. - Write down who can reach it. A recovery key only one person knows is lost the day that person is on a plane or gone. - Keep shared secrets, such as a client’s logins, the backup password and API keys, in a password manager. A chat message, a ticket or a notes file is a copy you will not find again. - When a project ends, change the keys a client gave you. Cancelling a key at the service that issued it is what stops it working. Deleting your copy does not. The guide on [handing over client API keys](https://cybee.ai/blog/client-api-key-handover/) walks through it. > Losing the key loses the files. Leaking it opens them. **Q:** What is a recovery key? ### What a recovery key is. A long code that macOS generates when you turn on FileVault and choose a key over your iCloud account. It opens the disk if you forget your login password. A business can also set a recovery key for its Macs. Whoever holds it can open the disk, so treat it like the password itself. Apple’s own warning is plain: if you lose both the password and the key, the files and settings on that Mac are gone for good. [A work Mac is missing: first steps](https://cybee.ai/blog/lost-work-mac/) ## What a client review asks, and where Cybee fits. A security questionnaire asks about encryption in three shapes. “Are laptops encrypted?” “Is data encrypted in transit?” “Are backups and cloud storage encrypted, and who holds the keys?” Answer them separately, because each rests on a different kind of evidence. For the laptops, use the setting on each Mac with a date. Say a seven person agency checks on 28.10.2026: “FileVault was on for six of seven Macs. The seventh is a spare with no client files and is being wiped.” For the connection, name the services client files pass through and what each one’s documentation says. You cannot prove that from a Mac. For the cloud and the backups, use each provider’s settings and your own backup disk, and name who holds the keys. Where you have not checked something, say that. A visible gap reads better than “everything is encrypted”. The [guide to answering a security questionnaire](https://cybee.ai/blog/mac-security-questionnaire/) shows how. Cybee covers the first place only. The menu bar card on each Mac shows disk encryption as one of its four protections. Ask your AI assistant which Macs have disk encryption on, and Cybee answers from what it observed on each Mac. If a Mac has it off, Cybee tells you, and that Mac goes on your list. When a client wants a record they can keep, the Trust Passport, a dated record of how your Macs are protected, answers “disk encryption on every listed Mac” with dates. Cybee runs on Macs with an Apple chip, M1 or newer, on macOS 15 or newer. Cybee never sends passwords, keys or tokens off your Mac. It is not a password manager and not a backup tool. Where Cybee stops It reads the setting on each Mac. It does not look at your connections, your cloud services or your backup disks, so those answers still come from you and your providers. Free for every Mac Checking the settings and telling you which are off is free. The Trust Passport is part of the Cybee subscription, which has a 14 day trial. [See the plans](https://cybee.ai/pricing/). [Read a Trust Passport properly](https://cybee.ai/docs/trust-passport/)[The menu bar card](https://cybee.ai/product/menu-bar/) ## What to remember. - Check the three places one at a time. A lock in one says nothing about the others. - For every cloud service and backup, know who holds the key. - Keep recovery keys away from what they protect, and change client keys when the work ends. ## Sources and product scope. Written by Cybee for small teams. The outside pages below were read on 28.10.2026. Apple and the cloud providers change their settings, so check the page for your own setup. Our documentation sets out what Cybee covers today. - [Apple: Protect data on your Mac with FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac) - [Apple Platform Security: Volume encryption with FileVault](https://support.apple.com/guide/security/volume-encryption-with-filevault-sec4c6dc1b6e/web) - [Apple: iCloud data security overview](https://support.apple.com/en-us/102651) - [Apple: Keep your Time Machine backup disk secure](https://support.apple.com/guide/mac-help/keep-your-time-machine-backup-disk-secure-mh21241/mac) - [Apple: Choose a backup disk and set encryption options](https://support.apple.com/guide/mac-help/choose-a-backup-disk-set-encryption-options-mh11421/mac) - [Apple: About the Time Machine backup password](https://support.apple.com/guide/mac-help/about-the-time-machine-backup-password-mh35720/mac) - [UK NCSC: Cloud security principle 2, asset protection and resilience](https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles/principle-2-asset-protection-and-resilience) - [UK NCSC: Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model) - [UK NCSC: Cloud security principle 1, data in transit protection](https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles/principle-1-data-in-transit-protection) - [IETF: RFC 8446, the TLS protocol](https://www.rfc-editor.org/rfc/rfc8446) - [Cybee: Safer settings](https://cybee.ai/docs/hardening/) ## Find out which Macs have the lock off. See the settings Cybee checks on every Mac, disk encryption among them, and what it tells you when one is off. [See the safer settings](https://cybee.ai/docs/hardening/) On this page - Three places your data sits - On the Mac - On the way - In the cloud and in backups - Keep the keys apart - What a client review asks - What to remember - Sources Cybee Shows which Macs have disk encryption on, and since when. Free for every Mac. [See how it works](https://cybee.ai/product/) ## Keep your Macs and your keys in order. Three more guides. [Mac security A work Mac is missing. What should you do first? Report it, check the controls you have, review account access and keep the useful records. Read the guide](https://cybee.ai/blog/lost-work-mac/) [your team Who still has your client’s API keys? Keys in scripts, automations or AI tools at a handover: what to keep, what to replace and what to remove. Read the guide](https://cybee.ai/blog/client-api-key-handover/) [Mac security Are Macs secure enough for a small business? What your Mac already protects, what your business still needs to check and how to keep a useful record. Read the guide](https://cybee.ai/blog/mac-security-small-business/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. What the command does - Installs a notarized agent on this Mac. - Creates no account. The install is identified by a token. - Starts protecting the device at once. - Changes no setting until you confirm it in your AI assistant. - Asks for this Mac’s administrator password once, and for no email address. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)