A SMAAT study can use end-to-end encryption, server-side encryption or a self-managed study key. The options differ in who holds the key, who can read the data, which features work, and what happens when a key is lost. This post sets out each option and what a data management plan or ethics application should state about it.