Encryption & Data Protection

How data is encrypted in transit and at rest, and how keys and secrets are managed.

Covers the NIST SP 800-171 System & Communications Protection (SC) and Media Protection (MP) families.

In transit

• TLS 1.2 or higher on every external connection. Plain HTTP is redirected to HTTPS at the load balancer; certificates are issued and rotated through AWS Certificate Manager.
• Traffic between the application and AWS services (storage, secrets, keys) travels over private connectivity inside the VPC — it does not transit the public internet.
• Database connections from the application use TLS.

At rest

• The application database is encrypted with AES-256 using a customer-managed AWS KMS key, and its backups are encrypted with the same key.
• Uploaded files are stored in object storage with KMS server-side encryption and versioning enabled, in buckets with all public access blocked.
• Audit logs are stored encrypted with tamper-evident validation (see Logging & Monitoring).

Encryption uses FIPS 140-2 validated cryptographic modules provided by AWS KMS.

Keys and secrets

• Encryption keys are customer-managed KMS keys with rotation support; key policies restrict which roles may encrypt or decrypt.
• Application secrets — database credentials, token-signing secrets — live in AWS Secrets Manager, not in code, container images, or plain environment files.
• User passwords are bcrypt-hashed; no reversible credential storage exists anywhere in the platform.

Physical media

Physical storage media is entirely within AWS data centers, so media handling, transport, and sanitization (NIST 800-88) are inherited from AWS — no storage media is ever handled by Foxx Cyber personnel. See Shared Responsibility.