Nifi controller passwords stored at rest

[jeff whybark]

Hello, I am looking to find information on how passwords are stored at rest
in Nifi 1.3 to satisfy security requirements for my organization.  This is
mainly related to the passwords in the controller settings.  Are they
encrypted by default?  Are they stored in the flow.xml.gz file?  Thanks for
your help.  Jeff