Encryption at rest
The Platform encrypts selected stored content at the application layer using AES-256-GCM. Infrastructure encryption and application content encryption are separate controls; this page describes the application boundary.
What is encrypted
- Provider credentials: Encrypted because the server needs to decrypt them for permitted provider calls.
- API transcript content and session titles: Encrypted in the database.
- Stored request/response and model/tool content snapshots: Encrypted where retained under the content-expiry policy.
- Platform API access keys: Stored as digests, not usable plaintext keys. The secret is shown once at creation.
Account, configuration, usage and policy metadata are not universally covered by this content encryption. File bodies are processed transiently and omitted from retained content; the Platform has no file object store. See data handling.
The service can decrypt retained encrypted content for authorised processing. This is not end-to-end encryption. Public endpoints use TLS; provider transport depends on the endpoint configured by your organisation.
What you can do
Cloud operators manage the encryption configuration. Private Deployment operators supply and protect the database encryption keys, including keys needed to restore backups. For control over provider egress, use Data routing policy and BYOK. Zero data retention is an option on a customer-owned Gateway connection; it does not disable the Platform’s own evidence retention.
For a broader picture of how we handle data, see Data handling and the Privacy Policy .