Settings

Vault encryption

The vault is encrypted at rest using a per-agency key. You can rotate the key or export everything at any time.

Encryption: AES-256 at rest. Key per agency, stored in a separate KMS-backed enclave.
Rotation: Settings → Vault → Rotate. Old data is decrypted with the old key, re-encrypted with the new.
Export: Settings → Vault → Export all. Downloads a tarball.
Wipe: only the agency admin can wipe. Two confirmations. Asynchronous.