Disks · Opensource internals

ClickHouse Encrypts Files at Rest with a 64-Byte Header

Oct 22, 2026 12 min read Jay Hubbert

ClickHouse’s encrypted disk prepends a self-describing 64-byte header and AES-CTRs the payload beneath it.

Clickhouse Internals Encryption Security Disks

How ClickHouse Spreads Parts Across Disks: the Storage Policy

Oct 22, 2026 11 min read Jay Hubbert

ClickHouse places parts with a three-level reserve ladder: policy → volume → disk, with per-volume part-size limits and TTL-driven moves.

Clickhouse Internals Storage Disks Mergetree