Encryption and Key Management

Encryption in transit and at rest, key ownership model, rotation, and key event visibility.

Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: Implemented

This page summarizes Tero’s encryption controls for cloud data and how key ownership and operations differ between hosted and self-hosted deployments.

Reviewer focus

• How data is encrypted in transit and at rest
• Who owns and administers encryption keys by deployment model
• How Tero handles key visibility, rotation, and revocation

Implementation status (March 5, 2026)

Tero encrypts sensitive and confidential data paths in transit and at rest in hosted environments.

Encryption controls

Area	Implementation
Data in transit	TLS-protected external API and service communication
Data at rest	Cloud-provider encryption for databases, storage, and backups
Secrets storage	Managed secret systems with restricted access

Key ownership and access model

Topic	Tero-hosted	Self-hosted
Key ownership model	Cloud-provider managed keys in hosted stack	Customer-selected key model
Key and secret administration	Restricted by IAM and RBAC with least privilege	Customer-defined
Key usage visibility	Cloud logging and monitoring paths	Customer-defined

Rotation and revocation baseline

• Key lifecycle follows cloud-provider rotation and lifecycle controls.
• Tero supports rotation and revocation for integration credentials and secrets.
• Tero supports emergency revocation for compromised credentials.

Evidence you can request

Topic	Primary evidence
Detailed policy language	Encryption Standard
Architecture controls	Security Architecture
Data scope and retention	Data Handling, Data Retention

Exceptions and governance

Any exception requires documented approval, compensating controls, and a time-bound remediation plan.

Evidence requests: