---
type: concept
x-llmwiki:
  schemaVersion: "0.1"
  contentHash: f8a830026192f9d85087f51862592fa58e3983dc4adb9444d976c115ddf0586b
  pageDirectory: concepts
  sources:
    - custom-classifiers-databricks-on-aws.md
  confidence: 0.9
  provenanceState: extracted
  freshnessStatus: unverified
  aliases:
    - encryption-of-classification-metadata
    - EOCM
  citations:
    - file: custom-classifiers-databricks-on-aws.md
title: Encryption of Classification Metadata
description: Custom classifier configuration and detection metadata are encrypted at rest, and a customer-managed key (CMK) on the system catalog can be used to manage the encryption key.
tags:
  - security
  - encryption
  - unity-catalog
timestamp: "2026-06-18T11:25:34.575Z"
---

# Encryption of Classification Metadata

**Encryption of Classification Metadata** refers to the protection at rest of the configuration and detection metadata generated by [Data Classification](/concepts/data-classification.md) in [Unity Catalog](/concepts/unity-catalog.md), including data from [Custom Classifiers](/concepts/custom-classifiers.md). Databricks encrypts this metadata and allows administrators to manage the encryption key using a Customer-Managed Key (CMK) on the system catalog. ^[custom-classifiers-databricks-on-aws.md]

## Overview

When Data Classification scans tables in Unity Catalog, it produces classification results—such as which columns match built-in or custom classifiers—and stores the associated metadata. For [Custom Classifiers](/concepts/custom-classifiers.md), the system also retains the example columns and the detection rules derived from them. All of this classification metadata is encrypted at rest. ^[custom-classifiers-databricks-on-aws.md]

## Encryption Mechanism

The encryption of classification metadata is handled by Unity Catalog’s default server-side encryption. The custom classifier configuration (i.e., the governed tag and example columns selected) and the detection metadata that Databricks generates from those examples are both encrypted at rest. No separate key management is required unless the administrator wants to use a customer-managed key. ^[custom-classifiers-databricks-on-aws.md]

### Customer-Managed Key (CMK)

Administrators can optionally configure a customer-managed key on the system catalog to manage the encryption key. This is done through Catalog Explorer by selecting the system catalog and configuring a CMK. ^[custom-classifiers-databricks-on-aws.md]

> It is important to note that configuring a CMK on the system catalog encrypts **all** data in the system catalog, not just custom classifier data. The system catalog stores system tables, such as audit logs and lineage, so applying a CMK will affect the entire system catalog’s content. ^[custom-classifiers-databricks-on-aws.md]

The screenshot in the source shows a Catalog Explorer UI where a user can “Configure a customer-managed key on the system catalog.” ^[custom-classifiers-databricks-on-aws.md]

## Scope and Limitations

- The encryption covers all classification metadata generated by both built-in and custom classifiers.
- The default encryption does not require any action from the administrator; it is always active.
- Using a CMK is optional and applies to the entire system catalog, not just classification metadata.
- No other encryption settings (e.g., per-table CMK) are described for classification metadata in the source.

## Related Concepts

- [Data Classification](/concepts/data-classification.md) – The feature that scans and tags sensitive data.
- [Custom Classifiers](/concepts/custom-classifiers.md) – User-defined classifiers that extend built-in detection.
- [Unity Catalog](/concepts/unity-catalog.md) – The data governance platform that provides encryption.
- Customer-Managed Key (CMK) – An optional key managed by the customer for encrypting Unity Catalog data.
- System Catalog – The catalog that stores system tables, audit logs, and classification metadata.
- [Governed Tags](/concepts/governed-tags.md) – Tags used by custom classifiers and ABAC policies.

## Sources

- custom-classifiers-databricks-on-aws.md

# Citations

1. [custom-classifiers-databricks-on-aws.md](/references/custom-classifiers-databricks-on-aws-61f050db.md)
