Welund.ai uses AES-256-GCM authenticated encryption to protect original documents uploaded to private client workspaces. This internationally recognised technology protects both confidentiality and data integrity.
What is AES-256-GCM?
AES-256-GCM combines the Advanced Encryption Standard (AES) with Galois/Counter Mode (GCM). AES-256 encrypts information using a 256-bit secret key. GCM adds cryptographic authentication, allowing unauthorised changes to encrypted information to be detected. Together they provide authenticated encryption with associated data (AEAD).
How AES-256 encryption works
AES transforms readable information, known as plaintext, into unreadable ciphertext. It operates on 128-bit blocks and uses 14 rounds of mathematical transformation with a 256-bit key. There are 2²⁵⁶ possible keys, making exhaustive key searching computationally impractical using currently known technology.
Why GCM matters
Galois/Counter Mode produces an authentication tag alongside the ciphertext. When encrypted information is accessed, the authentication tag is verified to detect unauthorised alteration. GCM also requires a unique nonce for each encryption operation performed under the same key. Correct nonce management is essential to maintaining the security of the system.
How Welund.ai protects original documents
Documents uploaded to private client workspaces are processed for authorised AI analysis, while the original files are protected using AES-256-GCM authenticated encryption. Encryption keys are managed separately from the encrypted files. Original documents are decrypted when required for an authorised operation, while their stored versions remain encrypted.
Encryption and artificial intelligence search
Welund.ai generates vector embeddings from extracted document information to support semantic search. These mathematical representations are held in Welund’s specialist vector database. They allow the system to identify relevant information through meaning and context rather than exact word matches alone. Embeddings are not encrypted copies of the original documents and cannot simply be decrypted to recreate them. However, they may reveal information about source material and must be protected as sensitive derived data.
What happens when a document is deleted?
Deleting a private document removes its encrypted original and corresponding searchable vector embeddings and indexed records from the active document systems. This prevents the deleted material from remaining available through the active workspace search facilities. Backup retention and operational records may be governed by separate retention policies.
Why AES-256-GCM is internationally recognised
AES is standardised in NIST FIPS 197, while Galois/Counter Mode is specified in NIST SP 800-38D. These established standards are used across government, financial services and security-sensitive computing environments. AES-GCM also benefits from hardware acceleration on many modern processors, supporting efficient encryption and decryption.
Security without sacrificing usability
Welund.ai combines encrypted original document storage with AI-powered retrieval and analysis. Authorised users can work with private information without manually managing encryption operations. Encryption is one part of a broader security architecture that also requires authentication, workspace isolation, access controls, secure key management and responsible information lifecycle management.
Technical standards
NIST FIPS 197 — Advanced Encryption Standard (AES). NIST SP 800-38D — Galois/Counter Mode (GCM) and GMAC.
Welund.ai — Advanced intelligence. Protected information.
← Return to Private Documents