How are my user entered config values secured at rest?

How does it work?
1

I am concerned about sensitive configuration values such as TLS certs, or service tokens on the filesystem at rest. How are these secured?

2

These config values are encrypted with a unique key per install.