A. Encryption at Rest

All persistent data is encrypted using industry-standard cryptographic algorithms.

• Database Encryption: All volumes (MongoDB, Neptune, Redis) are encrypted using AES-256.

• Key Management: Cryptographic keys are managed via AWS Key Management Service (KMS), allowing for automated rotation and strict audit logging of key usage.

B. Encryption in Transit

Data in motion is protected to prevent interception or tampering.

• Protocol: All internal and external data transmission occurs over TLS 1.2+ (Transport Layer Security).

Certificate Management: Certificates are managed via AWS Certificate Manager (ACM) with automated renewal.