This whitepaper provides a deep dive into the encryption at rest for extracts feature introduced in Tableau Server 2019.3. Encryption at rest for extracts gives customers the ability to specify additional protection for Tableau data extract files persisted on Tableau Server. It allows for Operating System users to be created that can access the Server file system, but lack access to the specific encryption keys that are needed to decrypt the extract files stored on them. The solution provides a simple, secure, and performant implementation that can be used on its own or in addition to external volume-based encryption solutions.