Encryption
Encryption protects every namespace in transit and at rest under its own keys, rotated on schedule with every old key kept.
Encryption protects every namespace in transit and at rest under its own keys. Keys rotate on a schedule, and every old key is kept, so every past record still reads.
Contract
Encryption cannot be turned off. It is a locked Setting at the platform root, so no Startup or Tenant inherits a way around it.
| Layer | Guarantee |
|---|---|
| In transit | TLS on every Interface: API, SDK, CLI, MCP, webhooks, Sites and Apps |
| At rest | Records, Files, the analytics copy and backups, encrypted per namespace |
| Keys | Each namespace's data keys are wrapped under the platform root key |
| Rotation | A scheduled Workflow re-wraps every namespace's keys once a year |
| Old keys | Kept as versions, so history and backups stay readable |
| Outside keys | Filled into requests server-side and never placed in a model's context |
| Recordings | Inputs masked at capture |
Every rotation is an Event in the audit log. An auditor reads the rotation history like any other record.
Verbs
None.
Interfaces
Example
clausewise.legal, a contract-review Service, stores its clients' agreements as Files. A client's security team asks for proof of rotation. An Agent sends the year's rotation Events and the key version behind each File.