# Security Features - TiDB Dedicated versus TiDB Serverless

| Feature                                                         | Dedicated | Serverless |
| :-------------------------------------------------------------- | :-------- | :--------- |
| Encryption in transit by TLS 1.2/1.3                            | Yes       | Yes        |
| Encryption at rest by cloud vendor's integrated storage service | Yes       | Yes        |
| CMEK (Customer Managed Encryption Key) for encryption at rest   | Yes       | No         |
| Console audit logging                                           | Yes       | Yes        |
| Database audit logging                                          | Yes       | No         |
| VPC private endpoint                                            | Yes       | Yes        |
| VPC peering                                                     | Yes       | No         |
| IP access list                                                  | Yes       | No         |
| `GRANT/REVOKE` DCL support                                      | Yes       | No         |
| User managed database role                                      | Yes       | No         |
| Built-in serverless database role                               | No        | Yes        |

------------------------------------------------------------------------------
[no notes]