The Wave Encryption at Rest services are built natively into the Wave platform. The solution applies strong, probabilistic encryption on data stored at rest. Platform encryption is based on the Advanced Encryption Standard (AES) with 256-bit keys using CTR mode and an initialization vector (IV) for every write. All operations, including sort and group-by, work the same as without encryption, except for key management.
The data you add to the database is encrypted on the Salesforce service, but archived data is not encrypted.