# Encrypted fields

An entity field can be stored encrypted:
`notes: ClinicalNote { encrypted: true }`. It is sealed with your app's
one `field_encryption_key:` and decrypted when it is loaded. An encrypted
field is kept out of unique rules, indexes, filters, ordering, search and
logs.

There are no per-person keys (see [Erasure](erasure.md#what-erasure-doesnt-rewrite)).
Keys can also be held as data: a key per device or person in an
encrypted field, usable only as a `crypto` call's `key:`
([Hashing and cryptography](hashing-and-cryptography.md)).

Every field sent to an AI model is listed in the report above
([Following personal data](following-personal-data.md)).