Encryption

Version: 1.0
Last Reviewed: 2026-03-07
Review Cadence: Quarterly
Classification: Internal / Customer-Shareable
Owner: Perceive8 Engineering & Security

---

Table of Contents

1. Encryption Summary
2. Encryption in Transit
3. Encryption at Rest
4. Key Management
5. Cryptographic Standards
6. Data in Processing
7. Backup Encryption
8. Gap Analysis
9. Encryption Roadmap

---

Encryption Summary

Layer	Status	Standard	Details
Transit (API)	✅ Enforced	TLS 1.2+	All HTTP, WebSocket, and webhook traffic
Transit (Internal)	✅ Enforced	TLS 1.2+	Service-to-service and database connections
At Rest (Database)	✅ Infrastructure	AES-256	Supabase/PostgreSQL managed encryption
At Rest (Object Storage)	✅ Infrastructure	AES-256	MinIO server-side encryption
At Rest (Application)	⚠️ Not implemented	—	Planned: field-level encryption for PII
Secrets	✅ Hashed/Protected	bcrypt, HMAC-SHA256	API keys hashed, webhooks signed
Backups	✅ Infrastructure	AES-256	Provider-managed backup encryption

---

Encryption in Transit

TLS Configuration

All external-facing endpoints enforce TLS 1.2 or higher. TLS 1.0 and 1.1 are not supported. Plaintext HTTP connections are rejected or redirected to HTTPS.

Property	Value
Minimum TLS Version	1.2
Preferred TLS Version	1.3
Certificate Authority	Let's Encrypt / Railway-managed
Certificate Rotation	Automatic (managed by hosting provider)
HSTS	Enabled (max-age=31536000; includeSubDomains)

Cipher Suites

TLS cipher suite selection is managed by the hosting infrastructure (Railway) and API gateway (Kong). The configuration follows modern best practices:

TLS 1.3 Cipher Suites (preferred):

• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256
• TLS_AES_128_GCM_SHA256

TLS 1.2 Cipher Suites (supported):

• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-CHACHA20-POLY1305

Disabled:

• RC4, DES, 3DES cipher suites
• Export-grade ciphers
• NULL ciphers
• Cipher suites without forward secrecy

Certificate Management

Aspect	Details
Issuance	Automated via hosting provider (Railway)
Renewal	Automatic, typically 30 days before expiry
Revocation	Managed by hosting provider; manual revocation available
Monitoring	Certificate expiry monitored as part of uptime checks
Key Size	RSA 2048-bit minimum / ECDSA P-256

Encrypted Channels

Channel	Protocol	Encryption
REST API	HTTPS	TLS 1.2+
WebSocket Streams	WSS	TLS 1.2+
SSE/EventSource	HTTPS	TLS 1.2+
Webhook Delivery	HTTPS	TLS 1.2+ (+ HMAC-SHA256 payload signing)
Database Connections	PostgreSQL SSL	TLS 1.2+
Object Storage	HTTPS	TLS 1.2+
AI Provider APIs	HTTPS	TLS 1.2+

---

Encryption at Rest

Infrastructure-Level Encryption

Database (Supabase / PostgreSQL)

Property	Value
Provider	Supabase (managed PostgreSQL)
Encryption	AES-256 at the storage layer
Key Management	Managed by Supabase infrastructure
Scope	All data stored in PostgreSQL — user data, transcripts, analysis results, metadata
Transparency	Encryption/decryption is transparent to the application

All data stored in the Supabase PostgreSQL database is encrypted at rest using AES-256 encryption managed by the underlying cloud infrastructure. This includes:

• User account metadata
• Conversation records and transcripts
• Analysis results and AI-generated insights
• API key hashes and OAuth client records
• Audit log entries
• Billing and subscription data
• Webhook configurations

Object Storage (MinIO)

Property	Value
Provider	MinIO (S3-compatible, self-hosted)
Encryption	Server-Side Encryption (SSE)
Algorithm	AES-256-GCM
Key Management	MinIO-managed encryption keys
Scope	Audio files, processed artifacts, exported data

MinIO supports server-side encryption (SSE) for all stored objects. Audio files uploaded by customers and processed artifacts are encrypted at the storage layer.

Application-Level Encryption

Current State: Application-level encryption at rest is not currently implemented. The application relies on infrastructure-level encryption provided by Supabase and MinIO.

What This Means:

• Data is encrypted on disk by the infrastructure providers.
• Data is decrypted transparently when accessed by the application through authenticated connections.
• There is no additional application-layer encryption envelope around sensitive fields.
• A compromise of database credentials would expose data in cleartext (mitigated by access controls and network isolation).

Planned: Field-level encryption for PII fields. See Encryption Roadmap.

Sensitive Data Handling

While application-level encryption at rest is not yet implemented, sensitive credentials are protected:

Data Type	Protection Method	Details
API Keys	bcrypt hash (cost=12)	Only the hash is stored; plaintext is shown once at creation
API Key Prefix	Plaintext	pk_live_ prefix stored for lookup; not the full key
JWT Signing Secret	Environment variable	Never stored in database or source code; validated ≥32 chars at startup
OAuth Client Secrets	bcrypt hash	Hashed before storage
Webhook Signing Secrets	Environment variable	Used for HMAC-SHA256 signing
Stripe Secrets	Environment variable	Used for webhook verification
AI Provider API Keys	Environment variable	Never stored in database

---

Key Management

Current Approach

Perceive8 currently manages cryptographic keys and secrets through environment variables:

Secret	Storage	Rotation
JWT Signing Secret	Environment variable	Manual; requires redeployment
API Key bcrypt hashes	PostgreSQL (Supabase)	Per-key; no automated rotation
Webhook HMAC Secret	Environment variable	Manual; requires redeployment
Stripe Webhook Secret	Environment variable	Manual; per Stripe dashboard
AI Provider API Keys	Environment variable	Manual; per provider dashboard
MinIO Access Keys	Environment variable	Manual; requires redeployment
Database Connection String	Environment variable	Manual; per Supabase dashboard

Key Protection

• Environment variables are set through the hosting provider's secrets management (Railway).
• Secrets are not committed to source control. .env.example files document required variables without values.
• The JWT signing secret is validated at application startup to ensure it meets minimum length requirements (≥32 characters).

Limitations

• No automated key rotation: All secrets require manual rotation and redeployment.
• No Hardware Security Module (HSM): Keys are stored in software, not in dedicated hardware.
• No envelope encryption: There is no master key / data key hierarchy.
• No key versioning: Rotating a key invalidates all tokens/signatures using the old key.

Planned Approach

See Encryption Roadmap for planned improvements including:

• Managed secrets service (e.g., AWS Secrets Manager, HashiCorp Vault)
• Automated key rotation workflows
• API key rotation mechanism for customers
• Envelope encryption for field-level encryption

---

Cryptographic Standards

Algorithms in Use

Algorithm	Use Case	Standard	Details
AES-256	Encryption at rest	NIST FIPS 197	Infrastructure-level (Supabase, MinIO)
AES-256-GCM	Object storage encryption	NIST SP 800-38D	MinIO server-side encryption
bcrypt	API key hashing	—	Cost factor 12; Blowfish-based
HMAC-SHA256	Webhook payload signing	RFC 2104	Outbound webhook integrity verification
HMAC-SHA256	Stripe webhook verification	RFC 2104	Inbound Stripe event verification
HS256 (HMAC-SHA256)	JWT signing	RFC 7519	Supabase-issued JWT tokens
TLS 1.2+	Transport encryption	RFC 5246 / 8446	All external and internal connections

Password / Key Hashing

Parameter	Value
Algorithm	bcrypt
Cost Factor	12
Salt	Automatically generated per hash
Output	60-character bcrypt hash string
Use	API key verification, OAuth client secret verification

JWT Token Security

Parameter	Value
Algorithm	HS256 (HMAC-SHA256)
Issuer	Supabase
Audience	authenticated
Expiry	Enforced; tokens rejected after expiry
Secret Length	Minimum 32 characters (validated at startup)

---

Data in Processing

Audio Processing Pipeline

When audio data is submitted for processing, it passes through several stages:

Customer → [TLS] → Perceive8 API → [TLS] → AI Provider → [TLS] → Perceive8 API → [Encrypted Storage]

Stage	Protection
Upload	TLS 1.2+ encrypted transit; MIME type validation
Temporary Storage	Stored in MinIO with server-side encryption
AI Provider Transit	TLS 1.2+ to provider APIs (AssemblyAI, OpenAI, Hume, etc.)
AI Provider Processing	Per provider security policies; DPAs prohibit training on customer data
AI Provider Retention	Providers do not retain data beyond processing window (per DPAs)
Results Storage	Stored in Supabase PostgreSQL with infrastructure encryption
Results Delivery	TLS 1.2+ encrypted transit to customer

Real-Time Streaming

Stage	Protection
WebSocket Connection	WSS (TLS 1.2+)
Audio Chunks	Encrypted in transit; processed in memory
Stream Results	Delivered over encrypted WebSocket; stored with infrastructure encryption
Stream Limits	Per-user concurrent stream limits enforced

AI Provider Security

Perceive8 integrates with multiple AI providers for transcription and analysis. For each provider:

• Data is transmitted exclusively over TLS-encrypted connections.
• Data Processing Agreements (DPAs) are in place prohibiting use of customer data for model training.
• Providers are listed in our Subprocessors registry.
• Provider API keys are stored as environment variables, never in source code or databases.

See Data Inventory for complete data flow documentation.

---

Backup Encryption

Database Backups

Property	Value
Provider	Supabase
Backup Frequency	Daily (managed by Supabase)
Backup Encryption	AES-256 (infrastructure-managed)
Backup Location	Provider-managed; same region as primary
Backup Retention	Per Supabase plan (typically 7-30 days)
Backup Access	Restricted to Supabase infrastructure; not directly accessible

Object Storage Backups

Property	Value
Provider	MinIO
Backup Strategy	Infrastructure-dependent
Backup Encryption	Inherits MinIO SSE configuration

---

Gap Analysis

The following table identifies encryption gaps and their risk assessment:

Gap	Risk Level	Impact	Mitigation	Planned Resolution
No application-level encryption at rest	Medium	Database credential compromise would expose cleartext data	Infrastructure encryption + access controls + network isolation	Field-level encryption for PII (Q3 2026)
No field-level encryption for PII	Medium	PII fields (names, emails) not individually encrypted	Infrastructure encryption covers all fields	Field-level encryption implementation (Q3 2026)
No automated key rotation	Medium	Compromised keys remain valid until manual rotation	Strong key generation + access controls	Secrets management service (Q4 2026)
No HSM for key storage	Low	Keys stored in software could be extracted from memory	Environment variable isolation + hosting provider security	Evaluate HSM/KMS integration (Q4 2026)
No envelope encryption	Low	Single layer of encryption at infrastructure level	Infrastructure encryption is industry-standard for managed services	Implement with field-level encryption (Q3 2026)
JWT uses HS256 (symmetric)	Low	Shared secret between issuer and verifier	Secret validated for length; managed by Supabase	Evaluate RS256 migration if multi-service verification needed
No certificate pinning	Low	Relies on CA trust chain	Standard TLS verification; managed certificates	Evaluate for mobile/native clients

---

Encryption Roadmap

Q2 2026 — Foundation

• Implement structured logging for encryption-related events
• Document encryption key inventory with rotation schedules
• Evaluate managed secrets services (AWS Secrets Manager, HashiCorp Vault)
• Implement API key rotation workflow for customers

Q3 2026 — Application-Level Encryption

• Implement field-level encryption for PII fields (names, email addresses)
• Implement envelope encryption (master key + data encryption keys)
• Add encryption key versioning to support rotation without data loss
• Encrypt sensitive fields in audit logs

Q4 2026 — Managed Key Infrastructure

• Migrate secrets to managed secrets service
• Implement automated key rotation for infrastructure secrets
• Implement customer-managed encryption keys (CMEK) for enterprise customers
• Evaluate HSM/KMS integration for key storage

2027 — Advanced

• SOC 2 Type II audit covering encryption controls
• Third-party cryptographic review
• Evaluate post-quantum cryptography readiness

---

Related Documents

Document	Description
Security Overview	Customer-facing security summary
Access Control Model	Authentication and authorization details
Incident Response Plan	Security incident procedures
Data Inventory	Complete data flow documentation
Subprocessors	Third-party data processors
Retention Schedule	Data retention policies
GDPR Readiness	GDPR compliance assessment (coming soon)
HIPAA Review	HIPAA compliance assessment (coming soon)

---

Document History

Version	Date	Author	Changes
1.0	2026-03-07	Perceive8 Engineering	Initial release

---

This document is reviewed quarterly. Next scheduled review: 2026-06-07.