On this page
Three places your data sits.
Encryption scrambles a file so that nobody can read it without the right key. The scrambling is rarely the hard part. The hard part is that every place your data sits has its own lock, set by a different company or a different setting, and nobody tells you when one of them is open.
Your files rest on the Mac. They travel from the Mac to a service and back. And copies wait in the cloud and in backups, on machines you do not own or on a disk in a drawer. A Mac with its lock on says nothing about the other two places.
where your data sitsthree locks
| Where | The lock | What to check |
|---|---|---|
| On the Macthe disk inside the laptop | FileVault, the Mac’s own disk encryption | Is it on for every Mac that holds client work, and where is the recovery key? |
| On the wayfrom your Mac to a service and back | A secure connection, called TLS, that your browser shows as https | Does every service that gets client files use it, and does any old tool send them over a plain route? |
| In the cloud and in backupscopies on other machines and other disks | The provider’s encryption, and the encryption of your own backup disk | Who holds the key, and is the backup disk encrypted? |
On the Mac, switch on FileVault.
FileVault is the Mac’s own disk encryption. With it on, the files on the startup disk can be read only after someone enters your login password or the recovery key. A lost or stolen laptop then holds scrambled data, not your client’s files.
Every Mac with an Apple chip already encrypts its internal disk. Apple’s security guide says what FileVault adds. With it off, only the chip inside the Mac guards the key, so the Mac can open its own disk without your password. With it on, your password guards the key too. Macs with Apple’s T2 security chip do the same. On older Macs without one, nothing is encrypted until you switch FileVault on.
You can check this Mac by Mac in a few clicks. If you look after several, write down which Macs you looked at and on what date, because that is the answer a client wants.
System SettingsFileVault
- 1
Open System Settings.
Click the Apple menu in the top left corner and choose System Settings. You need to be an administrator of the Mac to change what you find.
- 2
Find FileVault.
Click Privacy & Security in the sidebar, then scroll down to FileVault.
What you will see: the FileVault row. If it is off, a Turn On button is there.
- 3
Choose how to get back in.
If you turn it on, macOS asks how you want to get back in when you forget your password: with your iCloud account or with a recovery key. If you pick the key, write down where you keep it.
On the way, use a connection nobody can read.
When you open a web address that starts with https, or upload a file to a client’s portal, your Mac and the service agree on a key and scramble everything between them. The technology behind it is called TLS. The standard that defines it describes its job as a secure channel between two parties. Nobody in the middle can read what passes. Nobody can change it without being noticed. And the service proves who it is with a certificate, so an impostor cannot pose as it.
For most work, this is already done. Browsers, email programs and cloud tools use it without being asked. What is left for you is the exceptions. An old file transfer tool or a script may still send client files over a plain connection. A login page whose address starts with http, without the s, sends your password in the clear. A café or hotel network may show a warning that the connection is not private. Stop at that warning rather than clicking through.
TLS only protects the trip. Once the file arrives, the service holds it, and what happens next is the third place.
What does TLS mean?
What TLS means.
TLS stands for Transport Layer Security. It is the standard way two programs on the internet set up a private, tamper evident connection. You meet it as https at the start of a web address.
It protects data while it moves. It says nothing about how the receiving service stores the data afterwards.
In the cloud and in backups, ask who holds the key.
A good cloud service encrypts what it stores. The UK National Cyber Security Centre says providers should encrypt all customer data at rest within the service. That is guidance for providers, not a promise from any one of them, so the useful question is not whether your files are encrypted. It is who can read them.
iCloud shows the difference. By default, Apple keeps the keys for iCloud Drive and iCloud Backup, among others, which is why Apple can restore your access after you forget your password. If you turn on Advanced Data Protection, your trusted devices hold the keys instead. More categories become end to end encrypted, which means only your own devices can read them, and Apple cannot get your data back for you if you lose access. Apple makes you set up a recovery contact or a recovery key first.
Neither setting is wrong. One favours recovery, the other privacy. Choose on purpose and write down which you chose, so that a client who asks “who can read our files?” gets an answer and not a shrug. The NCSC is clear about the split: you keep responsibility for configuring the services you pick securely and for deciding which data goes into them.
Backups are where people forget. A Time Machine disk in a drawer holds every file your Mac held, and anyone who picks it up can read it unless it is encrypted. Apple calls encrypting the backup disk the best way to keep backups secure. In Finder, Control click the disk, choose Encrypt, then set a password and a hint. You can also choose encryption when you set up the disk in System Settings, under General and Time Machine. A network backup disk that you switch to encrypted loses its existing backups and starts again.
To restore files from an encrypted backup you must give the backup password, and Apple says nobody but you should have it. Keep it wherever you keep your recovery keys.
Keep the keys apart from the locks.
Encryption moves the risk from the data to the key. That is a good trade only if you look after the key. A few habits cover most small teams.
- Keep the FileVault recovery key away from the Mac it opens. Apple says to store a copy somewhere other than the encrypted startup disk. Your team’s password manager, or a printout in a locked drawer, works.
- Write down who can reach it. A recovery key only one person knows is lost the day that person is on a plane or gone.
- Keep shared secrets, such as a client’s logins, the backup password and API keys, in a password manager. A chat message, a ticket or a notes file is a copy you will not find again.
- When a project ends, change the keys a client gave you. Cancelling a key at the service that issued it is what stops it working. Deleting your copy does not. The guide on handing over client API keys walks through it.
Losing the key loses the files. Leaking it opens them.
What is a recovery key?
What a recovery key is.
A long code that macOS generates when you turn on FileVault and choose a key over your iCloud account. It opens the disk if you forget your login password. A business can also set a recovery key for its Macs.
Whoever holds it can open the disk, so treat it like the password itself. Apple’s own warning is plain: if you lose both the password and the key, the files and settings on that Mac are gone for good.
What a client review asks, and where Cybee fits.
A security questionnaire asks about encryption in three shapes. “Are laptops encrypted?” “Is data encrypted in transit?” “Are backups and cloud storage encrypted, and who holds the keys?” Answer them separately, because each rests on a different kind of evidence.
For the laptops, use the setting on each Mac with a date. Say a seven person agency checks on 28.10.2026: “FileVault was on for six of seven Macs. The seventh is a spare with no client files and is being wiped.” For the connection, name the services client files pass through and what each one’s documentation says. You cannot prove that from a Mac. For the cloud and the backups, use each provider’s settings and your own backup disk, and name who holds the keys. Where you have not checked something, say that. A visible gap reads better than “everything is encrypted”. The guide to answering a security questionnaire shows how.
Cybee covers the first place only. The menu bar card on each Mac shows disk encryption as one of its four protections. Ask your AI assistant which Macs have disk encryption on, and Cybee answers from what it observed on each Mac. If a Mac has it off, Cybee tells you, and that Mac goes on your list. When a client wants a record they can keep, the Trust Passport, a dated record of how your Macs are protected, answers “disk encryption on every listed Mac” with dates. Cybee runs on Macs with an Apple chip, M1 or newer, on macOS 15 or newer.
Cybee never sends passwords, keys or tokens off your Mac. It is not a password manager and not a backup tool.
What to remember.
- Check the three places one at a time. A lock in one says nothing about the others.
- For every cloud service and backup, know who holds the key.
- Keep recovery keys away from what they protect, and change client keys when the work ends.
Sources and product scope.
Written by Cybee for small teams. The outside pages below were read on 28.10.2026. Apple and the cloud providers change their settings, so check the page for your own setup. Our documentation sets out what Cybee covers today.
- Apple: Protect data on your Mac with FileVault
- Apple Platform Security: Volume encryption with FileVault
- Apple: iCloud data security overview
- Apple: Keep your Time Machine backup disk secure
- Apple: Choose a backup disk and set encryption options
- Apple: About the Time Machine backup password
- UK NCSC: Cloud security principle 2, asset protection and resilience
- UK NCSC: Cloud security shared responsibility model
- UK NCSC: Cloud security principle 1, data in transit protection
- IETF: RFC 8446, the TLS protocol
- Cybee: Safer settings
Find out which Macs have the lock off.
See the settings Cybee checks on every Mac, disk encryption among them, and what it tells you when one is off.
