LUKS software disk encryption with standard setup (cipher: aes-xts-plain64, size: 256) is used.
Librem 14, Librem Mini and Librem servers come with PureOS with OEM setup, which pre-encrypts the disk but allows customer to set up their own disk encryption password. Boot partition is not encrypted but it can be verified with Librem Key (see PureBoot).
Librem 5 also comes with internal encryption.
We are using PureBoot.
Librem Tunnel utilizes OpenVPN.