Encryption and keys

Owner: Mira Holm

At rest

• Databases, files and backups: AES-256, with keys in AWS's key service (KMS), one set per region.
• Our keys are rotated every year.
• Secrets we hold for customers (single sign-on certificates' private keys, MFA secrets, API key hashes) are encrypted again in identity-service with a separate key.
• Passwords are stored as bcrypt hashes. We can't read them.

In transit

• TLS 1.2 or later everywhere customers or their people connect.
• Between our services inside a region: TLS.
• SAML responses are signed by the customer's identity provider; we check the signature on every sign-in.

Not offered

• Keys held by the customer. Nobody has asked twice.

Who can use the keys

Only the services that need them, through their AWS roles. People can't decrypt data directly; support sees customer data only through a support session (Support access to customer data).