Data Encryption
Traffic is protected in transit, sensitive credentials are encrypted at the field level, and memory content is encrypted with keys scoped to your tenant.
What is protected, and where
All API and dashboard traffic travels over TLS. Plain HTTP is not an option, and webhook deliveries also require HTTPS endpoints.
Keep your own receivers on valid certificates, and never send credentials over an untrusted channel.
Rotating keys
Rotation is available as an explicit action in Settings → Organization, under the danger zone. It generates new keys and re-encrypts existing data, which is why it is grouped with other irreversible operations.
- When to rotate
- After a suspected credential or key exposure, or on whatever cadence your own security policy requires.
- Versioned keys
- Encrypted records carry the key version used to protect them, so replacing a key does not lose access to older data.
- Tenant isolation
- Keys are scoped per tenant, which keeps one organization’s data cryptographically separate from another’s.
- Rotation is audited
- The action is recorded in the audit trail with the acting user, alongside other administrative changes.
- Plan for the run
- Re-encryption touches existing data. Start it deliberately rather than during a release window.
There is no self-service key custody or bring-your-own-key configuration in the dashboard today. If your security review needs commitments beyond what is described here, request them through your account contact rather than inferring them from behavior.