Encryption Levels
The Encryption Level setting applies only when the engine is Sodium. It selects among four options with different performance characteristics.
Where to find it
Architect Panel → Configuration:
- Site Settings — Encryption Level — applies only with the Sodium engine
The four levels
- ActiveManage standard — the default, described as very fast.
- Level 1 — very fast.
- Level 2 — fast.
- Level 3 — slow.
Slower is not simply stronger
It is tempting to read the list as a strength ladder and pick the slow one. Resist that.
The cost of these levels is paid on every read and write of every encrypted field — on every form load, every list, every API response that includes one. On a datastore with several encrypted fields and a busy list view, the difference between very fast and slow is not academic; it is the difference between a page that loads and one that people complain about.
Meanwhile the threat these levels differ over is not the one most installations face. Data is lost through a mislaid backup, an over-broad permission or a compromised account — not through somebody defeating a well-chosen modern cipher.
Keep the default
The ActiveManage standard is the intended setting and is very fast. Change it only if you have a specific requirement that names something else, and measure the effect if you do.
Measure before and after
If you do change it, take a benchmark from the status panel first, load a form and a list containing encrypted fields, and compare. A change that makes a routinely used screen noticeably slower will be reversed eventually — better to find that out deliberately than after a fortnight of complaints.
Set it before encrypting data
As with the engine and the cipher: data written under one level is read under the same one. Decide at setup.
It does nothing under OpenSSL
If your engine is OpenSSL, this setting is ignored and Encryption Cypher is the one that applies. Changing the level while running OpenSSL has no effect whatsoever.
The real performance lever is what you encrypt
Far more significant than the level is how many fields are encrypted and whether they appear in list views. An encrypted field in a browse view showing fifty rows is fifty decryptions per page load.
Keep encrypted fields off list views where you can, and encrypt only what genuinely needs it.
Worked example
A team running Sodium considers moving to the slowest level for a datastore holding health information. They benchmark first and find the case list — which showed two encrypted fields — takes noticeably longer. They keep the default level and instead remove the encrypted fields from the list view, which improves performance and reduces how often the data is displayed at all.
Recommendations
- Keep the default level.
- Do not treat slower as stronger.
- Benchmark before and after any change.
- Keep encrypted fields out of list views.