Encryption

We protect your communications and your credentials with industry-standard encryption, and we are equally clear about how far that encryption goes.

Encryption in transit

All traffic between your users and the application travels over HTTPS with TLS (TLS 1.2 and 1.3). Unencrypted traffic is automatically redirected to HTTPS.
Certificates are issued by a recognized public certificate authority via a standard automated protocol (ACME), and are renewed automatically before they expire.
Administrative access travels over an encrypted private administration network, and sensitive internal communication between components is also protected in transit.

Secrets encrypted at rest

Credentials, keys, and tokens are kept encrypted in a dedicated secrets manager, with minimal access, rotation, and traceability. They are never stored in plain text. See Secrets management.

Data and backups at rest: what protects them

We would rather tell you before you ask: the encryption at rest we provide is limited to secrets. Neither your environment's data volumes nor its backups are encrypted at rest on our side, because the storage they rely on does not currently support server-side encryption. It is open work with our infrastructure provider, and while it is unresolved we would rather write it down than leave it out.

What does protect that data, and what we can state:

In transit it is always encrypted, including when it is uploaded to the backup storage.
Isolation: each environment has its own database, its own storage and its own segmented network. See Isolation between environments.
Minimal, logged access to the storage, from a private administration network that is not exposed to the public Internet. See Access control.
Backup immutability: the first 7 days of every backup cannot be deleted by anyone, ourselves included. It protects against destruction, not against reading, and we say so. See Backups.
Residency: the data and its backups stay in Spain, in facilities with physical security and information security certification.

Algorithms

We use current, industry-standard algorithms and protocols:

In transit: TLS 1.2 / 1.3.
Certificate authentication: modern public-key algorithms (RSA / ECDSA).
Secrets at rest: standard symmetric encryption (AES-256) in the secrets manager.

We do not use obsolete algorithms or encryption configurations considered weak.

In one line

In transit: HTTPS/TLS 1.2-1.3. Your credentials and secrets: encrypted at rest in a dedicated manager. Your data and its backups: not encrypted at rest on our side; what protects them there is isolation, minimal access and backup immutability.