diff --git a/pkg/services/encryption/encryption.go b/pkg/services/encryption/encryption.go
index 31cef0392ed..2ab4bb4c492 100644
--- a/pkg/services/encryption/encryption.go
+++ b/pkg/services/encryption/encryption.go
@@ -2,6 +2,8 @@ package encryption
 
 import "context"
 
+// Service must not be used for encryption,
+// use secrets.Service implementing envelope encryption instead.
 type Service interface {
 	Encrypt(ctx context.Context, payload []byte, secret string) ([]byte, error)
 	Decrypt(ctx context.Context, payload []byte, secret string) ([]byte, error)
diff --git a/pkg/services/encryption/ossencryption/ossencryption.go b/pkg/services/encryption/ossencryption/ossencryption.go
index 4cf351f8fc7..60168b48e9c 100644
--- a/pkg/services/encryption/ossencryption/ossencryption.go
+++ b/pkg/services/encryption/ossencryption/ossencryption.go
@@ -14,6 +14,8 @@ import (
 	"golang.org/x/crypto/pbkdf2"
 )
 
+// Service must not be used for encryption,
+// use secrets.Service implementing envelope encryption instead.
 type Service struct{}
 
 func ProvideService() *Service {
diff --git a/pkg/services/secrets/secrets.go b/pkg/services/secrets/secrets.go
index faa0916d3fa..08090897ae8 100644
--- a/pkg/services/secrets/secrets.go
+++ b/pkg/services/secrets/secrets.go
@@ -6,6 +6,8 @@ import (
 	"xorm.io/xorm"
 )
 
+// Service is an envelope encryption service in charge of encrypting/decrypting secrets.
+// It is a replacement for encryption.Service
 type Service interface {
 	Encrypt(ctx context.Context, payload []byte, opt EncryptionOptions) ([]byte, error)
 	Decrypt(ctx context.Context, payload []byte) ([]byte, error)
@@ -14,6 +16,7 @@ type Service interface {
 	GetDecryptedValue(ctx context.Context, sjd map[string][]byte, key, fallback string) string
 }
 
+// Store defines methods to interact with secrets storage
 type Store interface {
 	GetDataKey(ctx context.Context, name string) (*DataKey, error)
 	GetAllDataKeys(ctx context.Context) ([]*DataKey, error)
@@ -22,6 +25,7 @@ type Store interface {
 	DeleteDataKey(ctx context.Context, name string) error
 }
 
+// Provider is a key encryption key provider for envelope encryption
 type Provider interface {
 	Encrypt(ctx context.Context, blob []byte) ([]byte, error)
 	Decrypt(ctx context.Context, blob []byte) ([]byte, error)
diff --git a/pkg/util/encryption.go b/pkg/util/encryption.go
index a494e93039f..ecddbca9899 100644
--- a/pkg/util/encryption.go
+++ b/pkg/util/encryption.go
@@ -15,8 +15,8 @@ import (
 const saltLength = 8
 
 // Decrypt decrypts a payload with a given secret.
-// Deprecated. Do not use it.
-// Use encryption.Service instead.
+// DEPRECATED. Do not use it.
+// Use secrets.Service instead.
 func Decrypt(payload []byte, secret string) ([]byte, error) {
 	if len(payload) < saltLength {
 		return nil, fmt.Errorf("unable to compute salt")
@@ -49,8 +49,8 @@ func Decrypt(payload []byte, secret string) ([]byte, error) {
 }
 
 // Encrypt encrypts a payload with a given secret.
-// Deprecated. Do not use it.
-// Use encryption.Service instead.
+// DEPRECATED. Do not use it.
+// Use secrets.Service instead.
 func Encrypt(payload []byte, secret string) ([]byte, error) {
 	salt, err := GetRandomString(saltLength)
 	if err != nil {