Encryption at rest
All data stores and log streams are encrypted at rest using AWS KMS. Enterprise plans include customer-managed KMS keys (CMKs) — giving your team independent control of key material, automatic annual rotation, key policies defined in Terraform and changed only through reviewed pull requests, and CloudTrail-evidenced decrypt records for every access.
| Protects | Scope |
|---|---|
| Aurora PostgreSQL cluster | All relational data at rest |
| ElastiCache Redis | At-rest encryption for cache and counters |
| S3 buckets | Files, audit archive, and exports |
| CloudWatch log groups | All application and infrastructure logs |
| Secrets Manager & SSM | Provider keys, credentials, configuration |
| Terraform state | The infrastructure definition itself |
Encryption in transit
- TLS on every public endpoint, with a wildcard ACM certificate covering all subdomains.
- Database connections require TLS at the RDS Proxy.
- Redis transit encryption is enabled.
Network isolation
- All workloads — containers and functions — run inside a VPC.
- AWS WAF fronts the public-facing endpoints.
- S3 buckets block public access and enforce SSE-KMS encryption.
- Databases are reachable only through RDS Proxy inside the VPC — never directly from the internet.
Access control
- Least-privilege IAM: each service role carries only the permissions that service needs.
- Single sign-on via OIDC with role-gated consoles; TOTP MFA enforceable for administrators.
- Sessions are short-lived (one hour) and delivered as HttpOnly, Secure cookies.
- API requests are re-verified at the governance gateway on every call — the browser session is not the security boundary.
Change control
- All infrastructure is Terraform. No manual console changes in production.
- Every infrastructure change runs format, validation, and two static security analyzers (checkov, tfsec) in CI before review.
- Production applies happen through CI with manual approval — not from developer laptops.
- KMS key deletion requires removing an explicit safeguard and waiting 30 days, making accidental destruction practically impossible.