you can either encrypt the storage on which you configure your datastores (e.g. using LUKS/cryptsetup), or use the built-in encryption feature to encrypt individual snapshots at rest (some metadata needs to remain unencrypted, but all the data chunks are fully encrypted).