> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Encrypt your database and files

> Protect ABBYY FlexiCapture 12 data using Transparent Data Encryption for databases and Windows EFS for storage, temp, import, and export folders.

ABBYY FlexiCapture 12 does not include any encryption mechanisms of its own, but allows you to use standard and recommended encryption technologies from well-known suppliers of operating systems and database management software.

## Database encryption

ABBYY FlexiCapture 12 supports Transparent Data Encryption (TDE), a technology for encrypting databases and protection of keys. Data are encrypted at the server level, and backups cannot be decrypted without a valid key.

Detailed information about how to encrypt data using SQL and Oracle is available on the [Microsoft](https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption?view=sql-server-2017) and [Oracle](https://docs.oracle.com/cd/E57990_01/pt853pbh2/eng/pt/tadm/concept_ImplementingTransparentDataEncryption-de7db6.html#topofpage) websites.

## File and temporary folder encryption

ABBYY FlexiCapture 12 supports Windows Encryption File System (EFS), a file encryption technology offered by Microsoft. EFS is used for encrypting files and folders on servers and client computers. It protects confidential information contained in files and folders by generating a unique key that uses a combination of server and user credentials.

For detailed instructions on enabling EFS, see [this section of the Microsoft website](https://docs.microsoft.com/en-us/windows/desktop/fileio/file-encryption).

When EFS is used in ABBYY FlexiCapture 12, the following folders are encrypted:

* **Storage folders** — The storage facility is controlled by the Application Server, so storage folders must be encrypted using the account under which the FlexiCapture 12 Web services application pool is running in IIS.
* **Processing Station temp folders** — Depending on which account is used to run the station, encrypt either the domain user's temp folder or the `NetworkService` temp folder (`C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp`).
* **Scanning Station and scanning plug-in temp folders and project folders** — Encrypt these folders (`C:\Users\<username>\AppData\Local\ABBYY\ScanStationFC\4.0` for the Scanning Station and `C:\Users\<username>\AppData\Local\ABBYY\ScanningPlugin\` for the scanning plug-in) using the account of the user that is using the Scanning Station.
* **Export and import folders** — The Processing Station must have access to the files in the import folder and write permissions for the export folder so that it can create files there. To encrypt the import folder, the user running the Processing Station must have access permissions to these files. To encrypt files before they are sent to the export folder, the Processing Station must use the key of the user running it, which lets that user decrypt the files later.

<Tip>
  Each file in an encrypted folder is encrypted separately for each user, so add files to the import folder using the account that runs the Processing Station. To give other users access to encrypted files, use the [`Cipher.exe`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cipher) command-line tool.
</Tip>