> ## Documentation Index
> Fetch the complete documentation index at: https://algolia.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Algolia Vault

> Algolia Vault provides AES-256 disk encryption at rest and a configurable firewall for an extra level of security and control.

export const ApplicationID = () => <Tooltip tip="A unique alphanumeric string that identifies an Algolia application." cta="Application ID (dashboard)" href="https://dashboard.algolia.com/account/api-keys">
    application ID
  </Tooltip>;

export const APIKey = () => <Tooltip tip="An alphanumeric string that controls access to the Algolia APIs. It defines what actions are allowed, such as searching an index or adding new records." cta="API key" href="/doc/guides/security/api-keys">
    API key
  </Tooltip>;

<Note>
  **Pricing**

  Algolia Vault is available an add-on to your [pricing plan](https://www.algolia.com/pricing/).
</Note>

Algolia Vault gives you an extra level of security and control over your data, beyond typical use-cases.

For example, a digital healthcare service might have medical records or personal user data that needs to be accessible to internal users only.
Algolia Vault exists to meet strict technical or compliance requirements that call for disk encryption and restricted access.

At its core, Algolia Vault provides two things:

* **Advanced Encryption Standard (AES-256) for disk encryption at rest**, with per-server keys.
* **Configurable firewall** to restrict access to specific IP addresses.

## Disk encryption

Algolia Vault applies disk encryption with 256-bit AES to all data at rest.
**You must set up Vault before indexing data to Algolia, and can't turn it off.**
If you didn't turn on Algolia Vault before creating the cluster,
you must create an entirely new encrypted cluster and migrate your data to it.

## Firewall

Algolia Vault comes with a firewall for both indexing and search API calls.
It provides network-level control over which IP addresses have access to the data you're storing with Algolia.
You can allow access for up to 1,000 IP addresses.

You can configure the firewall with the [Vaults API](/doc/rest-api/search),
or in the [**Infrastructure** section](https://dashboard.algolia.com/account/infrastructure/) of the Algolia dashboard.

<Note>
  All applications on the same cluster share the same firewall configuration.
</Note>

### Activate and deactivate the firewall

By default, the firewall is inactive, and all IP addresses (sources) can reach the server as long as they provide a valid <ApplicationID /> and <APIKey />.
If you add an IP address to the allowlist, the firewall becomes active.
**As soon as you enable the firewall, only sources on your allowlist can access your data.**

To let the Algolia support team access the API, add `ALGOLIA_SUPPORT` to the allowlist.

To turn off the firewall, add `0.0.0.0/0` to the configuration.

### Using the firewall with InstantSearch

In some types of IP-restricted implementations,
you might not be able to implement InstantSearch directly from the frontend.
You can still use InstantSearch by [implementing a backend proxy](/doc/guides/building-search-ui/going-further/backend-search/in-depth/backend-instantsearch/js) that makes all the requests from a server on your allowlist.

As with any proxy, this isn't as fast as with a frontend InstantSearch implementation.
However, it lets you create a full InstantSearch experience with all its features while enforcing strict access restrictions.