Automatic Encryption Service

What is the Automatic Encryption Service?

The Automatic Encryption Service is a FenixPyre Windows endpoint feature that automatically encrypts any file that is newly added to, or created within, a FenixPyre protected folder. It runs in the background on the Windows agent, so files are protected the moment they land in a protected folder - without users having to encrypt them manually.

---

What Problem Does It Solve?

Sensitive files are most exposed in the short window between when they are created and when someone remembers to protect them. Manual encryption is easy to forget and slow at scale. The Automatic Encryption Service removes that gap: as soon as a file appears in a protected folder, it is encrypted, ensuring consistent protection across everything saved or copied into those locations.

---

How Does It Work?

• The service monitors protected folders for file-creation events and encrypts each new file as it is added or created.

• It is enabled from the user policy under Endpoint Settings in the admin dashboard, and is enabled by default.

• When multiple files are added to a protected folder at the same time, they are processed sequentially - one file at a time.

The encryption delay

By default, encryption happens immediately. You can optionally configure a delay (in milliseconds) between when a file appears in a protected folder and when it is encrypted.

• Default value: 0 ms (immediate encryption).

• The delay is applied per file - each file waits for the full configured delay, not an accumulated total.

• We recommend keeping the delay below 60000 ms (1 minute).

A delay is useful when an application writes files into a protected folder in a way that conflicts with immediate encryption. For example, if an SFTP transfer is still writing a file to a protected folder, encrypting it the instant it appears can interrupt the transfer. Adding a small delay gives such operations time to complete before encryption begins.

Limitations

• The service does not encrypt zero-byte files.

• The service does not encrypt placeholder files (for example, online-only OneDrive/SharePoint files).

• Read-only files cannot be encrypted.

• A file may be missed if it is in use by another application or process at the time of encryption.

• In the rare case where automatic encryption fails for a newly added OneDrive/SharePoint file, the file remains unencrypted until the user edits and saves it in the same location.

---

Key Benefits

• Protects new files automatically, with no manual steps for end users.

• Enforces consistent encryption across every protected folder.

• The configurable delay prevents conflicts with applications that write files into protected folders.

---

Learn how to configure this from the Automatic Encryption Service policy settings.

The Periodic Encryption Service complements this feature by periodically scanning protected folders to catch any files that were missed.

Looking to encrypt files stored on cloud storage such as SharePoint/OneDrive, Box, or Egnyte? See Cloud Integrations to learn about Auto-Encryption on FenixShare.

For more information on how to enable and configure the Automatic Encryption Service, please contact FenixPyre Support.