encryption activatable for buckets only