Encrypting after-image files for an encryption-enabled database follows security best practices. By default, enabling your database for encryption, also enables your AI files for encryption. However, you can explicitly enable encryption of your AI files when you begin after-imaging offline, as shown:

rfutil db-name -C aimage begin -aiencryption enable