Techly Cryptography Policy

Purpose

This policy sets out where Techly Operations Pty Ltd (Techly) uses encryption in Pyron, which standards it uses, and how the keys are managed.

Scope

Data in transit to, from and within Pyron's production service; data at rest in its database, file storage, backups and secret stores; and the keys that protect them.

Standards

• Only established algorithms and well-maintained libraries are used. Techly writes no cryptography of its own.
• Encryption at rest uses AES-256. Integrity uses SHA-256 or stronger.
• Encryption keys are generated and held by AWS Key Management Service. Other secrets, such as the key that signs sign-in tokens, are held in AWS's encrypted parameter store. Neither is ever written into code or configuration.

In transit

• To Pyron. Pyron is served only over HTTPS, with TLS 1.2 or later (TLS 1.3 where the browser supports it). Plain HTTP is redirected, and browsers are told never to use it.
• From the edge to Pyron's servers. Traffic travels through an encrypted tunnel, and the edge accepts only a valid certificate from the origins it serves.
• To the database. The database refuses any connection that is not encrypted, and Pyron verifies the database's certificate.
• To file storage. Storage refuses any request that is not encrypted.
• Inside Pyron's private network. Traffic between Pyron's own services inside its cluster is not encrypted. Network policies limit which services can reach each other.

At rest

• The database and its backups are encrypted with a key Techly controls in AWS Key Management Service.
• Stored files are encrypted with keys in AWS Key Management Service.
• The cluster's secrets and disks are encrypted.
• Key rotation. The keys Techly controls rotate automatically every year.

Encrypted a second time

A few values are secrets in themselves, so they are sealed again inside the database, each with its own key and bound to its workspace: the secrets behind authenticator apps, and the short-lived handoff records of single sign-on. A copy of the database, or of a backup, does not reveal them.

Secrets, passwords and keys

• Credentials a workspace keeps in the Pyron Vault are stored encrypted in AWS's parameter store, apart from the database.
• Passwords are stored only as salted, slow hashes (PBKDF2 with SHA-256).
• API keys are stored only as SHA-256 hashes, shown once when they are made, and compared in constant time.
• Webhooks with a signing secret are checked by their signature and their time, so an old one cannot be replayed.
• Sign-in tokens are signed, and expire.

Key management

• Access to use a key is granted only to the services and roles that need it, and every use of a key Techly controls is recorded by AWS CloudTrail.
• Techly's read-only access to its cloud accounts cannot decrypt anything.
• A key suspected to be compromised is handled as an incident: rotated, and the data it protected re-encrypted.

Who is responsible

• The Technical Director owns this policy and the keys.

Review

The Technical Director reviews this policy every year, and when a standard it relies on is weakened.