How We Protect Your Data with Encryption

We encrypt sensitive personally identifiable information (PII) and business-critical data at rest in our database. This includes:

• User credentials: Email addresses and personal names
• Organization information: Organization names and metadata
• Assessment data: Product names, versions, and intended use information
• SBOM components: Package names, versions, and license information
• Vulnerability details: CVE descriptions and severity information
• Remediation plans: Fix recommendations and tracking
• Notifications: Alert content and metadata

We use AES-256-GCM, a NIST-approved encryption standard used across government, healthcare, and financial sectors. Here's what that means:

• AES-256: The encryption algorithm uses 256-bit keys, considered computationally infeasible to brute-force with current technology.
• Authenticated encryption: The "GCM" part means encrypted data is verified for tampering. If data is modified in any way, decryption fails automatically.
• Industry standard: This is the same encryption used by security-conscious organizations across healthcare, finance, and government.

1. Plaintext to ciphertext: When sensitive data is stored, it's encrypted using a unique key (specific to each data type) before being written to the database.
2. Unique randomization: Each encryption uses a fresh random value, so the same plaintext encrypted twice produces completely different ciphertexts—preventing pattern analysis.
3. Tamper detection: Each encrypted piece of data includes a verification tag that proves it hasn't been modified since encryption.
4. Decryption on retrieval: When you request data, it is securely decrypted by backend services with controlled access to encryption keys.

Encryption is only as strong as the key. We protect keys using multiple layers:

• Never hardcoded: Keys are never stored in code or version control.
• Secure storage: In production, encryption keys are stored in Azure Key Vault, a dedicated secrets management service that meets compliance standards (SOC 2, HIPAA, ISO 27001).
• Access controls: Access to encryption keys is restricted to authorized backend services based on least-privilege principles. Keys are never exposed to frontend code or API responses. We are continuously improving our key-management architecture to reduce backend exposure of raw key material.
• Isolation per environment: Development, staging, and production each use separate encryption keys.
• Access controls: Encryption keys are not accessible to unauthorized third parties.

Not all data needs encryption. We balance security with usability. Data that is NOT encrypted includes:

• Assessment status: Whether an assessment is "draft" or "completed" (not sensitive)
• Scan metadata: Timestamps, scan counts, and status flags (metadata only)
• CVE severity levels: Public CVSS scores (publicly available information)

Encrypting all data would make the platform slower and harder to use (e.g., searching your SBOMs). We encrypt the data that matters most and protect the rest with access controls and secure transport (HTTPS/TLS).

Encryption at rest protects data stored in the database. We also protect data while it's in transit:

• HTTPS/TLS: All communication between your browser and our servers is encrypted using TLS 1.2 or higher.
• Certificate validation: Browser certificates are validated to prevent man-in-the-middle attacks.
• Secure headers: We enforce HSTS and CSP policies to protect against common web attacks.

Our encryption practices help meet regulatory requirements:

• GDPR Article 32: Encryption is a required safeguard for processing personal data. We meet this obligation.
• EU Cyber Resilience Act: CRA encourages encryption of sensitive data. Our practice aligns with this guidance.
• Industry standards: AES-256 is recommended by NIST, BSI, and other leading cybersecurity authorities.

Encryption is one part of a complete security program. You also play an important role:

• Strong passwords: Use unique, strong passwords and enable multi-factor authentication.
• Account access: Only grant platform access to people who need it. Remove access promptly when people leave.
• Data minimization: Only upload the SBOMs and data you need. Don't store unnecessary information.
• Regular backups: We maintain encrypted backups. Always verify you can restore data if needed.

Security is a shared responsibility. Encryption protects your data while it's with us. Proper access controls protect it from misuse.

This page covers high-level encryption practices. If you have questions about:

• Specific encryption key rotation procedures
• Data residency or compliance certifications
• Third-party audit reports or penetration test results
• Custom encryption requirements for your organization

Please use our contact form to reach out. We're happy to discuss security practices with your team.