Skip to main content
Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: Implemented This page summarizes encryption controls for cloud data and how key ownership and operations differ between hosted and self-hosted deployments.

What this page answers

  • How data is encrypted in transit and at rest
  • Who owns and administers encryption keys by deployment model
  • How key usage visibility, rotation, and revocation are handled

Current state (as of March 5, 2026)

Sensitive and confidential data paths are encrypted in transit and at rest in hosted environments.

Encryption controls

AreaImplementation
Data in transitTLS-protected external API and service communication
Data at restCloud-provider encryption for databases, storage, and backups
Secrets storageManaged secret systems with restricted access

Key ownership and access model

TopicTero-hostedSelf-hosted
Key ownership modelCloud-provider managed keys in hosted stackCustomer-selected key model
Key and secret administrationRestricted by IAM and RBAC with least privilegeCustomer-defined
Key usage visibilityCloud logging and monitoring pathsCustomer-defined

Rotation and revocation baseline

  • Key lifecycle follows cloud-provider rotation and lifecycle controls.
  • Integration credentials and secrets are rotatable and revocable.
  • Emergency revocation path is supported for compromised credentials.

Evidence you can request

TopicPrimary evidence
Detailed policy languageEncryption Standard
Architecture controlsSecurity Architecture
Data scope and retentionData Handling, Data Retention

Exceptions and governance

Any exception requires documented approval, compensating controls, and a time-bound remediation plan. Evidence requests: