Encryption
We protect your communications and your credentials with
industry-standard encryption.
Encryption in transit
- All traffic between your users and the application travels over
HTTPS with TLS (TLS 1.2 and 1.3). Unencrypted traffic is
automatically redirected to HTTPS.
- Certificates are issued by a recognized public certificate authority
via a standard automated protocol (ACME), and are renewed
automatically before they expire.
- Administrative access travels over an encrypted private administration
network, and sensitive internal communication between components is
also protected in transit.
Secrets encrypted at rest
- Credentials, keys, and tokens are kept encrypted in a dedicated
secrets manager, with minimal access, rotation, and traceability. They
are never stored in plain text. See
Secrets management.
Algorithms
We use current, industry-standard algorithms and protocols:
- In transit: TLS 1.2 / 1.3.
- Certificate authentication: modern public-key algorithms
(RSA / ECDSA).
- Secrets at rest: standard symmetric encryption (AES-256) in the
secrets manager.
We do not use obsolete algorithms or encryption configurations considered
weak.
In one line
In transit: end-to-end HTTPS/TLS 1.2-1.3. Your credentials and secrets:
encrypted at rest in a dedicated manager.