Encryption
oklido uses industry-standard encryption to protect your documents and data.
Encryption at Rest
All stored data is encrypted using AES-256:
| Data Type | Encryption | Key Management |
|---|---|---|
| Documents | AES-256 | AWS KMS |
| Database | AES-256 | AWS RDS encryption |
| Backups | AES-256 | AWS KMS |
| Logs | AES-256 | AWS CloudWatch |
AWS Key Management Service (KMS)
We use AWS KMS for encryption key management:
- Keys are stored in dedicated hardware security modules (HSMs)
- Automatic key rotation every year
- Keys never leave AWS KMS unencrypted
- Full audit trail of key usage
Encryption in Transit
All data transmitted to and from oklido is encrypted:
| Connection | Protocol | Minimum Version |
|---|---|---|
| Web traffic | TLS | 1.2 (1.3 preferred) |
| API calls | TLS | 1.2 (1.3 preferred) |
| Database connections | TLS | 1.2 |
| Internal services | TLS | 1.2 |
TLS Configuration
- Protocols: TLS 1.2 and 1.3 only (older versions disabled)
- Cipher suites: Strong ciphers only, no known vulnerabilities
- Perfect Forward Secrecy: Enabled
- HSTS: Enforced with preload
Document Storage
Documents are stored in AWS S3 with multiple layers of protection:
-
Server-side encryption (SSE-KMS)
- Documents encrypted before writing to disk
- Decrypted only when accessed by authorised users
-
Bucket policies
- Public access blocked
- Access restricted to oklido application
-
Access logging
- All access attempts logged
- Audit trail for compliance
Database Encryption
PostgreSQL database (AWS RDS) encryption:
- Storage encryption: AES-256
- Connection encryption: TLS required
- Backup encryption: Same key as primary
Application-Level Security
Beyond infrastructure encryption:
- Sensitive fields: Additional encryption for PII
- API keys: Hashed, never stored in plain text
- Session tokens: Cryptographically secure random generation
- Password hashing: bcrypt with appropriate cost factor
What We Don't Encrypt
For performance and functionality:
- Document metadata (titles, types) - needed for search
- Audit logs - needed for compliance
- Usage analytics - aggregated, anonymised
These items are still protected by access controls and database encryption.
Verifying Encryption
You can verify our encryption:
- Check the padlock in your browser address bar
- View certificate details - issued to oklido.com
- Test with SSL Labs - we score A+
Compliance
Our encryption meets requirements for:
- GDPR Article 32 - Security of processing
- Cyber Essentials Plus - Cryptographic controls
- SOC 2 - Encryption requirements