diff --git a/backend/.env.example b/backend/.env.example
index dd79d8c..37bf508 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -10,3 +10,9 @@ JWT_SECRET=
 
 # RS256 JWKS verification (optional — falls back to HS256 if not set)
 # PLATFORM_JWKS_URL=http://localhost:4003/auth/.well-known/jwks.json
+
+# Field-level encryption
+FIELD_ENCRYPT_KEY_PROVIDER=memory
+FIELD_ENCRYPT_KEY=
+FIELD_ENCRYPT_MEK_NAME=chronomind-mek
+AZURE_KEYVAULT_URL=