# Encryption

URL: /code/platform/encryption · Id: `capability:encryption`

> Encryption protects every namespace in transit and at rest under its own keys, rotated on schedule with every old key kept.

Encryption protects every namespace in transit and at rest under its own keys. Keys rotate on a schedule, and every old key is kept, so every past record still reads.

## Contract
Encryption cannot be turned off. It is a locked [Setting](/business/nouns/setting) at the platform root, so no [Startup](/business/nouns/startup) or [Tenant](/business/nouns/tenant) inherits a way around it.

| Layer | Guarantee |
| --- | --- |
| In transit | TLS on every [Interface](/business/nouns/interface): API, SDK, CLI, MCP, webhooks, [Sites](/business/nouns/site) and [Apps](/business/nouns/app) |
| At rest | Records, [Files](/business/nouns/file), the analytics copy and backups, encrypted per namespace |
| Keys | Each namespace's data keys are wrapped under the platform root key |
| Rotation | A scheduled [Workflow](/business/nouns/workflow) re-wraps every namespace's keys once a year |
| Old keys | Kept as versions, so history and backups stay readable |
| Outside keys | Filled into requests server-side and never placed in a model's context |
| [Recordings](/business/nouns/recording) | Inputs masked at capture |

Every rotation is an [Event](/business/nouns/event) in the [audit log](/systems/trust-and-governance/audit-log). An auditor reads the rotation history like any other record.

## Verbs
None.

## Interfaces
- [API](/code/api/reference)
- [SDK](/code/sdk/reference)
- [CLI](/code/cli/reference)
- [MCP](/code/mcp/reference)

## Example
`clausewise.legal`, a contract-review [Service](/business/nouns/service), stores its clients' agreements as Files. A client's security team asks for proof of rotation. An [Agent](/business/nouns/agent) sends the year's rotation Events and the key version behind each File.