Encryption at every layer
Traffic is encrypted in transit with TLS, and sensitive credentials and secrets are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt, API keys are stored only as hashes, and encryption keys are managed separately from the data they protect.
What this looks like in practice
- All traffic between you and the platform is encrypted in transit with TLS.
- Sensitive credentials and secrets are encrypted at rest with AES-256-GCM.
- Passwords are never stored — only bcrypt hashes.
- API keys are stored only as hashes, so they can't be read back — by anyone.
- Encryption keys are managed separately from the data they protect.
Why it matters
Encryption only counts when it covers every state your data passes through — moving and stored. Keeping the keys separate from the data means that even if storage were ever exposed, the sensitive values in it stay unreadable.
- TLS in transit
- AES-256-GCM at rest
- bcrypt hashing
- Hashed API keys
- Separate key management
Have a security question?
We're happy to walk through our practices in more detail, share documentation, or hear about a concern. A human reads every note.
This page describes our security posture at a high level for transparency; it is not a contractual commitment.