Skip to main content
Session encryption protects the full raw content of your captured sessions — messages, tool calls, file diffs, and the rest of the session payload — at rest. It is available to Paid users as an individual toggle and to Enterprise organizations as an org-wide policy. Metadata, titles, tags, summaries, and stats remain unencrypted so search and analytics keep working without opening full transcripts.
Encryption is an opt-in feature on Paid and Enterprise plans. Free accounts do not have access to encrypted session storage.

​
What encryption protects

Understanding the encryption boundary helps you make informed decisions about what to store and how to configure your account. This split keeps encryption focused on raw session content while leaving derived metadata available for dashboards, stats, and search — so analytics stay fast and useful without forcing every view through a decrypt path.
1

Open account settings

Select Settings from the top navigation and scroll to Session Encryption.
2

Enable encrypted session storage

Toggle on Encrypted raw session storage. RCLM generates your recovery key immediately.
3

Download your recovery key

A one-time download prompt appears. Download the key now and store it in your password manager or secrets vault. This is the only time RCLM will show you the plaintext key.
4

Confirm and activate

Confirm that you have saved the key. Encryption activates for all sessions going forward.
RCLM does not email your recovery key and does not store the plaintext value. If you lose the downloaded key, RCLM cannot recover it for you. Store it in the same secure system you use for other sensitive credentials.

​
Recovery key mechanics

When you enable encryption, RCLM generates a recovery key and immediately prompts you to download it. After that moment:
  • The plaintext key is not stored anywhere in RCLM’s systems.
  • RCLM stores only a hash, the last few characters, and the generation timestamp — enough to confirm a key exists, but not enough to reconstruct it.
  • The recovery key download prompt does not appear again. If you need the key and cannot find it, it is gone.
Treat your RCLM recovery key the same way you treat an SSH private key or a secrets manager master password — store one copy in a secure password manager and, if your security policy requires it, a second copy in a separate safe location.

​
Enterprise: org-wide encryption

Enterprise org admins control encryption as an organization-level policy. Individual members do not generate or hold their own recovery keys under this model.
1

Open the enterprise portal

Open your organization in the Enterprise portal, select Settings, and find the encryption controls.
2

Enable org-wide encrypted session storage

Toggle on Org-wide encrypted session storage. RCLM generates one org recovery key.
3

Download the org recovery key

Download the org recovery key and store it in your organization’s secrets management system. Only one org recovery key exists per organization.
4

Configure decrypt access

Under Decrypt access policy, set which roles can open full encrypted session details. You can grant or restrict access for admins and team leads independently.

​
Enterprise admin decrypt controls

Admin access

Org admins can be granted or denied decrypt access to encrypted member session details. Configure this under the org’s decrypt-access policy.

Team lead access

Team leads can optionally be granted decrypt access scoped to their team’s sessions. This keeps team-level review possible without full org-wide access.
Enterprise encryption is org-wide, not per-user zero-knowledge encryption. Recovery is handled through a single org-held recovery key, giving your security team central control over the recovery material.

​
Frequently asked questions

No. Search, stats, summaries, filters, and dashboard views operate on derived metadata that stays unencrypted. Opening the full detail view of a session requires decrypt access, but browsing your session list, running searches, and viewing usage trends all work without decryption.
Encryption applies to sessions stored after you enable it. Previously stored sessions are not retroactively encrypted. If you need all sessions encrypted, contact support to discuss migration options.
Key rotation is on the roadmap. In the current version, one recovery key is generated per user or org. Watch the changelog for updates on rotation, customer-managed keys, and multiple key custodians.
Disabling encryption after it has been active requires care to handle already-encrypted sessions. Contact support before making this change if you have a large session history.