Cryptography & Key Management Policy

Governs how Finaisse protects data with encryption and manages cryptographic keys and secrets. Subordinate to the Information Security Policy.

Policy owner	Security & Infrastructure Owner (Sekhar Prakash)
Applies to	All Finaisse systems and data, in transit and at rest
Effective	2026-08-27 (v0.1 draft)
Review cadence	Annual + on major architecture change
Classification	Internal-confidential
SOC 2 / ISO	CC6.1, CC6.7 · ISO 27001 A.8.24

1. Purpose

Define the approved cryptographic controls and the lifecycle for keys and secrets, so that Restricted data (customer financial data and PII) is protected in transit and at rest, and so that cryptographic material is never exposed in source or logs.

2. Encryption in transit

• All external traffic is HTTPS-only. Production terminates TLS at the ALB with ACM certificates, HTTP→HTTPS redirect, and a WAF (F-13, resolved).
• Approved: TLS 1.2 or higher. 🎯 Target — enforce a minimum TLS version and modern cipher suites at the edge, and add security response headers (HSTS/CSP) (F-05).
• Internal service-to-service traffic runs on the provider private network; 🎯 Target — enable TLS for the Temporal client for AWS (F-10).

3. Encryption at rest

• Databases and object storage are encrypted at rest (AWS RDS/S3 with managed keys in the production design).
• 🎯 Target — customer-managed KMS keys (CMKs) with scoped grants, replacing broad kms:Decrypt on * (F-12); encrypted backups with defined retention (Data Classification Policy).

4. Key & secret management

• Secrets (JWT signing key, storage credentials, API keys) are held in the platform secret store as environment variables — never in source. Secrets found in version-control history are rotated and scrubbed (F-34, F-35).
• 🎯 Target (AWS) — a managed secrets service with automatic rotation and per-service least-privilege access (F-12, F-18).
• Cryptographic keys are rotated on a defined schedule and on suspected compromise.

5. Approved algorithms & prohibited practices

• Passwords/credentials: a work-factor KDF (argon2, bcrypt, or scrypt). 🎯 Target — migrate off salted SHA-256, which lacks a work factor (F-40).
• Data-subject identifiers to the LLM: reversible tokenisation at the model boundary (LLM PII Tokenization); the token↔real map is a re-identification key and is access-controlled and encrypted.
• Prohibited: custom/unvetted cryptographic implementations; storing secrets in code, logs, or client-readable locations.

6. Enforcement & exceptions

Non-compliant cryptographic use is remediated on discovery. Exceptions require owner approval with a recorded expiry.

7. Review

Reviewed annually and on major architecture change (notably the AWS production build, which lands several 🎯 targets above).

Revision history

Version	Date	Author	Change
0.1	2026-08-27	Security & Infrastructure Owner	Initial draft