§ Security & Compliance / Data Encryption
Stolen data,worthlessto everyone.
AES-256 at rest, TLS 1.3 in transit, and a key management ceremony that means losing a drive doesn't mean losing your customers' secrets.
§ Encryption — Where it applies
Two attack surfaces. Both sealed.
At rest
AES-256
Every database row, file and backup is encrypted before touching disk. Even our engineers can't read it without the key.
- AES-256-GCM
- Envelope encryption
- Key rotation: 90d
- Encrypted backups
In transit
TLS 1.3
All traffic between client, CDN, load balancer and database travels over TLS 1.3 — perfect forward secrecy, no downgrade.
- TLS 1.3 minimum
- HSTS + preloaded
- Certificate pinning
- No mixed content
§ Metrics — By the numbers
The numbers behind the lock
0
Bit encryption standard
0
Day key rotation cycle
0
TLS minimum version
0
Plaintext bytes on disk
§ Ready to encrypt
Keys managed.
Data locked.
A stolen disk is worthless noise.