> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Disk encryption

> Enforce full-disk encryption across your fleet and automatically escrow recovery keys so IT can always regain access without relying on employee credentials.

## Platform compatibility

| macOS         | Windows       | Linux | iOS / iPadOS | Android |
| ------------- | ------------- | ----- | ------------ | ------- |
| ✅ (FileVault) | ✅ (BitLocker) |       |              |         |

## Modify or remove the control

Disable the control from the profile settings. Disabling stops enforcement but does not remove existing encryption from devices.

## How it works

<Tabs>
  <Tab title="macOS">
    * **FileVault** manages encryption.
    * MDM installation enables FileVault automatically.
    * Encryption takes effect after the next restart.
    * Primo escrows the recovery key a few hours later.
  </Tab>

  <Tab title="Windows">
    * **BitLocker** manages encryption.
    * MDM installation enables BitLocker automatically.
    * No restart is required.
    * Primo stores the key as soon as encryption activates.
  </Tab>

  <Tab title="Linux">
    Configure disk encryption **at OS installation**, before MDM enrollment. Linux has no native mechanism to encrypt a disk after install — adding encryption later requires a full reinstall. **Fleet Desktop** (the agent running on the device) handles recovery key escrow, not the Primo interface.

    **Flow:**

    1. The employee encrypts their disk with **LUKS** during OS installation.
    2. Once enrolled, Fleet Desktop shows a banner prompting the employee to escrow their recovery key.
    3. The employee clicks **Create key** and enters their existing LUKS passphrase.
    4. Fleet generates and stores a new recovery passphrase server-side.

    For more details, see the FleetDM documentation:

    * [Linux disk encryption — end-user flow](https://fleetdm.com/guides/linux-disk-encryption-end-user)
    * [Enforce disk encryption with Fleet](https://fleetdm.com/guides/enforce-disk-encryption)
  </Tab>
</Tabs>