vSAN encryption is a vSphere feature to encrypt data at rest on the vSAN datastore.
Figure 7. vSAN encryption on VxRail cluster
vSphere also supports encryption at the virtual machine layer as an option to vSAN encryption.
Starting with VxRail 7.0.200, the native key provider that is embedded with vCenter can be used for encryption purposes.
Figure 8. Virtual machine encryption on VxRail cluster