A system (300, 440) for providing transparent, in-line encryption of data-at-rest, DAR, stored by a host controller (220, 420) of a host device (200, 400), the system comprising: a processor (210, 410); and a computing device that comprises a first set of instructions to be performed that when executed by the processor causes the system to: instantiate an encryption core comprising a storage device proxy, an encryption engine, and a plurality of host device proxies (350A, 350B, 100, 240, 450, 460), each host device proxy among the plurality of host device proxies interfacing the host controller to one persistent storage device among a plurality of persistent storage devices via the storage device proxy, the storage device proxy exposing the plurality of persistent storage devices to the host controller as a single persistent storage device through the encryption engine; receive a transfer command to initiate a data transfer operation from the host controller at the storage device proxy; determine an encryption state of the encryption engine; process the transfer command based on the data transfer operation initiated by the transfer command and an encryption state of the encryption engine, receive a zeroize command at the encryption engine; and in response to receiving the zeroize command, render an encryption algorithm associated with the encryption engine unusable and direct an embedded controller of the encrypted storage device to render at least a portion of data stored in the memory of the encrypted storage device unusable, wherein the plurality of persistent storage devices include an encrypted storage device providing memory to the host device for storing encrypted DAR through an encryption plugin of the encryption engine and a recovery storage device providing memory storing unencrypted recovery data usable to repair system resources of the host device through a null-encryption plugin of the encryption engine, and wherein the transfer command is routed to a host device proxy of a corresponding recovery storage device when the transfer command initiates a read operation and the encryption state is a zeroized state. instantiate an encryption core comprising a storage device proxy, an encryption engine, and a plurality of host device proxies (350A, 350B, 100, 240, 450, 460), each host device proxy among the plurality of host device proxies interfacing the host controller to one persistent storage device among a plurality of persistent storage devices via the storage device proxy, the storage device proxy exposing the plurality of persistent storage devices to the host controller as a single persistent storage device through the encryption engine; receive a transfer command to initiate a data transfer operation from the host controller at the storage device proxy; determine an encryption state of the encryption engine; process the transfer command based on the data transfer operation initiated by the transfer command and an encryption state of the encryption engine, receive a zeroize command at the encryption engine; and in response to receiving the zeroize command, render an encryption algorithm associated with the encryption engine unusable and direct an embedded controller of the encrypted storage device to render at least a portion of data stored in the memory of the encrypted storage device unusable, wherein the plurality of persistent storage devices include an encrypted storage device providing memory to the host device for storing encrypted DAR through an encryption plugin of the encryption engine and a recovery storage device providing memory storing unencrypted recovery data usable to repair system resources of the host device through a null-encryption plugin of the encryption engine, and wherein the transfer command is routed to a host device proxy of a corresponding recovery storage device when the transfer command initiates a read operation and the encryption state is a zeroized state.