> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption and Key Management

> Encryption in transit and at rest, key ownership model, rotation, and key event visibility.

export const securityEmail = "security@usetero.com";

<Badge>Last reviewed: March 5, 2026</Badge>
<Badge>Owner: Security + Engineering</Badge>
<Badge>Review cadence: Quarterly</Badge>
<Badge color="green">Status: Implemented</Badge>

This page summarizes Tero's encryption controls for cloud data and how key ownership and operations differ between hosted and self-hosted deployments.

## Reviewer focus

* How data is encrypted in transit and at rest
* Who owns and administers encryption keys by deployment model
* How Tero handles key visibility, rotation, and revocation

## Implementation status (March 5, 2026)

Tero encrypts sensitive and confidential data paths in transit and at rest in hosted environments.

## Encryption controls

| Area            | Implementation                                                |
| --------------- | ------------------------------------------------------------- |
| Data in transit | TLS-protected external API and service communication          |
| Data at rest    | Cloud-provider encryption for databases, storage, and backups |
| Secrets storage | Managed secret systems with restricted access                 |

## Key ownership and access model

| Topic                         | Tero-hosted                                     | Self-hosted                 |
| ----------------------------- | ----------------------------------------------- | --------------------------- |
| Key ownership model           | Cloud-provider managed keys in hosted stack     | Customer-selected key model |
| Key and secret administration | Restricted by IAM and RBAC with least privilege | Customer-defined            |
| Key usage visibility          | Cloud logging and monitoring paths              | Customer-defined            |

## Rotation and revocation baseline

* Key lifecycle follows cloud-provider rotation and lifecycle controls.
* Tero supports rotation and revocation for integration credentials and secrets.
* Tero supports emergency revocation for compromised credentials.

## Evidence you can request

| Topic                    | Primary evidence                                                                                 |
| ------------------------ | ------------------------------------------------------------------------------------------------ |
| Detailed policy language | [Encryption Standard](/trust/policies/encryption-standard)                                       |
| Architecture controls    | [Security Architecture](/trust/architecture)                                                     |
| Data scope and retention | [Data Handling](/trust/controls/data-handling), [Data Retention](/trust/policies/data-retention) |

## Exceptions and governance

Any exception requires documented approval, compensating controls, and a time-bound remediation plan.

Evidence requests: [{securityEmail}](mailto:\{securityEmail})