How data is protected in transit and at rest on the managed stack — plus BYOB and roadmap.
Browser and API traffic is protected with TLS using modern cipher suites. Custom hostnames use your own zone's TLS configuration when applicable.
Object storage, relational metadata, and every other managed service we bind rely on provider-managed encryption and enforced access boundaries. Our infrastructure providers are named in the subprocessor list, where you can review their own trust documentation.
When you attach your bucket, encryption keys and bucket policies are yours to configure (SSE-KMS, dual-layer, etc.).
We track demand for tenant-scoped key hierarchies or customer-held keys for selected payloads. Availability depends on what the underlying key-management features allow — not promised on a fixed date.