Skip to main content
Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: Implemented This standard defines encryption and key-management requirements for hosted deployments.

What this standard answers

  • Where encryption is required in transit and at rest
  • Which key-management controls are required
  • How exceptions are reviewed and approved

Current state (as of March 5, 2026)

The encryption and key-management requirements on this page are active in hosted production systems.

Scope

Applies to production systems, data stores, backups, service-to-service paths, and secrets handling.

Encryption requirements

AreaRequirement
Data in transitTLS is required for external API and service traffic
Data at restCloud-provider encryption controls are required for databases, storage, and backups
SecretsManaged secret systems are required; secrets are not stored in source code

Key-management requirements

AreaRequirement
Key servicesCloud key-management services
Access controlLeast-privilege IAM and RBAC for key and secret administration
RotationKey lifecycle follows cloud-provider rotation and lifecycle controls
Credential lifecycleIntegration credentials are rotatable and revocable
VisibilityKey and encryption events are available through logging and monitoring paths

Exceptions and governance

Exceptions require documented risk acceptance, Security and Engineering approval, compensating controls, and a time-bound remediation plan. Questions: