# Data Encryption {#data-encryption}


Encryption at rest and in transit for Gauzy deployments.


## In Transit (TLS) {#in-transit-tls}



### HTTPS Configuration {#https-configuration}


All production deployments must use TLS:

```nginx
server {
    listen 443 ssl http2;
    ssl_certificate /etc/ssl/certs/gauzy.crt;
    ssl_certificate_key /etc/ssl/private/gauzy.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}
```


### Internal Communication {#internal-communication}


- API ↔ Database: Use `sslmode=require`
- API ↔ Redis: Use `rediss://` (TLS)
- API ↔ S3: HTTPS endpoints


## At Rest {#at-rest}



### Database Encryption {#database-encryption}


PostgreSQL Transparent Data Encryption:

```sql
-- Check if encryption is enabled
SHOW ssl;
-- Result: on
```


### Column-Level Encryption {#column-level-encryption}


For sensitive data fields:

```typescript
@MultiORMColumn({
  transformer: new EncryptionTransformer({
    key: process.env.ENCRYPTION_KEY,
    algorithm: 'aes-256-gcm',
  }),
})
ssnNumber: string;
```


### File Storage Encryption {#file-storage-encryption}


```env
# AWS S3 server-side encryption
AWS_S3_ENCRYPTION=AES256
```


## Key Management {#key-management}


| Key               | Storage              | Rotation  |
| ----------------- | -------------------- | --------- |
| JWT Secret        | Environment variable | Quarterly |
| DB Encryption Key | Vault/KMS            | Annually  |
| S3 Encryption Key | AWS KMS              | Auto      |
| TLS Certificate   | File/Cert Manager    | 90 days   |


## Related Pages {#related-pages}


- [SSL Certificate Management](https://sourcey-gauzy.pages.dev/devops/ssl-certificate-management/index.md) — SSL
- [Security Headers](https://sourcey-gauzy.pages.dev/security/security-headers/index.md) — headers
- [Compliance](https://sourcey-gauzy.pages.dev/security/compliance-gdpr/index.md) — GDPR