# 15 Cryptography and key management policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Owner | Infrastructure Owner |
| Review | Yearly |
| Applies to | All in-scope systems and their secrets |

## Encryption

1. **In transit:** TLS 1.2 or higher on every external connection and every connection that leaves a host (database replicas, backups, vendor APIs). HSTS on every public hostname (ACC-12).
2. **At rest:** production disks, databases, object storage and backups are encrypted with AES-256 or the provider's equivalent (ACC-11). Backups are encrypted before they leave the host, with a key not stored beside them.
3. **P0 fields** additionally use application-level encryption with a separate key where the playbook requires it.
4. **Algorithms:** use the platform's standard libraries. No custom cryptography. Passwords use argon2id or bcrypt. Tokens stored at rest are hashed (SHA-256 or better) where only comparison is needed.
5. **Claims:** do not describe anything as end-to-end encrypted or zero-knowledge unless it is (red line 1).

## Secrets

1. Secrets live in [the secrets manager], or in environment files with mode 600 owned by the service user, or in systemd credentials. Never in git, container images, logs, tickets, chat, or AI prompts (ACC-13).
2. Secret scanning runs on every push and blocks a commit that contains one.
3. Each secret has an owner and a rotation date in the secrets inventory.
4. A secret that has ever been committed to git, pasted into a chat or an AI session, printed to a log, or held by someone who has left is **exposed** and is rotated within 24 hours. Removing it from git history is not a substitute for rotation.

## Rotation schedule

| Secret | Rotation |
| --- | --- |
| Signing keys (JWT, session, HMAC) | Yearly, with overlap (JWKS) so sessions survive |
| Database passwords | Yearly, and on departure of anyone who knew them |
| Vendor API keys | Yearly, and on departure |
| SSH keys and certificates | Certificates short-lived; keys removed on departure |
| Backup encryption keys | Retained for as long as backups encrypted with them exist; new key yearly |
| Any exposed secret | Within 24 hours |

Every rotation is logged with date, secret name (not value) and person (ACC-14).