Cryptography Policy

Last updated: October 28, 2026

Customer data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256, and keys are held in managed key and secret services with restricted, logged access.

Scope

All systems that store or transmit company or customer data, including GCP services, laptops and backups.

Policy

1. In transit. External traffic uses TLS 1.2 or higher with modern cipher suites; TLS 1.0/1.1 and plain HTTP (except redirects to HTTPS) are disabled. HSTS is enabled on public web domains. Internal service traffic within GCP is encrypted.
2. At rest. All GCP storage (Cloud SQL, Cloud Storage, persistent disks, backups) is encrypted with AES-256, using Google-managed keys by default, and customer-managed keys in the managed key service where extra control is needed.
3. Endpoints. Laptops use full-disk encryption (FileVault / BitLocker), verified twice a year (Acceptable Use Policy).
4. Passwords. Customer passwords are stored with a slow, salted hash (bcrypt, scrypt or Argon2). Plaintext passwords are never stored or logged.
5. Key management. Google-managed encryption keys are held in Google’s key management service and rotated by Google. Keys we generate are held in a secrets manager, with access limited to named roles and logged, and rotated at once if compromise is suspected. Keys whose rotation would invalidate stored data, such as the key for hashed IP addresses, are documented as exceptions.
6. Certificates. TLS certificates are issued by a trusted CA, renewed automatically, and monitored for expiry.
7. Approved algorithms. Use well-reviewed libraries and standard algorithms (AES-GCM, RSA ≥ 2048, ECDSA P-256 or Ed25519, SHA-256 or stronger). Do not write custom cryptography.