Encryption & Key Management
AUDT uses strong encryption for data in transit, data at rest, and for all secrets and credentials. No plaintext credentials are ever stored in the database.
Data in Transit
- Protocol
- TLS 1.2 minimum, TLS 1.3 preferred — enforced on all connections
- HSTS
- max-age=31536000; includeSubDomains; preload — 1-year max age
- Certificate
- Vercel-managed SSL — auto-renewed, OCSP stapling
- DB connections
- ssl:"require" — all PostgreSQL connections use TLS
- HTTP headers
- X-Frame-Options: DENY · X-Content-Type-Options: nosniff · Referrer-Policy: strict-origin-when-cross-origin
- CSP
- Content-Security-Policy enforced at Next.js response headers layer
Data at Rest — Integration Configs & Secrets
- Algorithm
- AES-256-GCM — authenticated encryption with associated data (AEAD)
- Key length
- 256-bit encryption key (32 bytes, hex-encoded)
- IV / Nonce
- Randomly generated 12-byte IV per encryption operation — never reused
- Auth tag
- 128-bit GCM authentication tag — detects tampering
- Key storage
- ENCRYPTION_KEY env var — set in Vercel, never in source code or DB
- Scope
- All integration credentials, third-party API keys, and webhook secrets
- Implementation
- Node.js built-in crypto module — no third-party crypto libraries
Passwords & API Keys
- Algorithm
- bcrypt — adaptive work factor, resistant to GPU cracking
- Work factor
- 12 rounds for passwords · 10 rounds for API keys
- API key display
- Shown once at creation — only the bcrypt hash is stored
- Password history
- Configurable per org — prevents reuse of recent passwords
- TOTP secrets
- AES-256-GCM encrypted before storage — decrypted only at verify time
- Recovery codes
- bcrypt-hashed individually — single-use, 10 codes per enrollment
Database Encryption
- Provider
- Supabase Postgres on AWS RDS — ap-south-1 (Mumbai)
- Encryption at rest
- AWS managed encryption — AES-256 on EBS volumes
- Backups
- Automated daily backups — encrypted at rest
- In-transit
- TLS enforced between app layer and Supabase Supavisor pooler
- WAL / logs
- Encrypted in transit and at rest on AWS infrastructure
File Storage Encryption
- Provider
- Supabase Storage — ap-south-1 (Mumbai)
- Encryption at rest
- AWS S3-managed encryption (SSE-S3) — AES-256
- Access control
- Tenant-prefixed storage paths + Row-Level Security on storage.objects
- Signed URLs
- 15-minute TTL signed URLs for all file downloads
- Buckets
- vendor-documents (legacy) and compliance-documents (current) — both private
Customer Managed Encryption (Enterprise)
- Status
- Available on Enterprise plan
- Providers
- AWS KMS · Azure Key Vault · Google Cloud KMS
- Model
- Bring Your Own Key (BYOK) — AUDT never holds the master key
- Audit log
- Every key usage event recorded in encryption_audit_logs