Encryption Standard

Document control

Field	Value
Document status	Active policy document
Owner	Security / Operations
Approver	Management
Review frequency	Annual or on material change
Classification	Customer-shareable

Purpose

Define baseline encryption requirements for protecting sensitive data in transit, at rest, in backups, and in credentials/secrets.

Data in transit

External web traffic and APIs must use TLS 1.2 or higher where supported. Administrative access must use secure protocols. Plaintext transfer of sensitive data over public or untrusted networks is not permitted.

Data at rest

Databases, file stores, backups, and managed storage containing confidential or personal data should use encryption at rest where supported by the platform. Portable media or local copies containing sensitive data must be encrypted or avoided.

Passwords and credentials

Passwords must never be stored in plaintext. Application credentials, API keys, tokens, SSH keys, and certificates must be protected in approved secret stores or restricted configuration mechanisms. Secrets must not be committed to source control.

Key management

Encryption keys must have defined ownership, restricted access, rotation/revocation process, and backup/recovery considerations. Access to keys must be limited to personnel and services with business need.

Exceptions

Exceptions must document business reason, affected data, compensating controls, owner, approval, and review date.

Evidence to maintain

TLS configuration, storage encryption settings, secret-management evidence, key access records, key rotation logs, and exception register.