> ## Documentation Index
> Fetch the complete documentation index at: https://v1-docs.adapt.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Encryption

> How Adapt encrypts your data at rest and in transit

All data in Adapt is encrypted using industry-standard encryption methods to protect your information.

## Encryption Overview

| Data State | Encryption Method |
| - | - |
| In Transit | TLS 1.3 |
| At Rest | AES-256 |
| Secrets | AES-256 with per-org keys |

## Encryption in Transit

All data transmitted to and from Adapt is encrypted:

### TLS 1.3

* **Protocol**: TLS 1.3 (latest standard)
* **Cipher suites**: Modern, secure algorithms only
* **Certificate**: Issued by trusted certificate authority
* **HSTS**: Strict transport security enforced

### API Connections

```
Your Browser ←→ TLS 1.3 ←→ Adapt
Your Integrations ←→ TLS 1.3 ←→ Adapt
Adapt ←→ TLS 1.3 ←→ Third-party APIs
```

All external connections use encrypted channels.

## Encryption at Rest

All stored data is encrypted:

### Database Encryption

* **Algorithm**: AES-256
* **Key management**: Google Cloud KMS
* **Scope**: All database fields, including backups

### File Storage

* **Algorithm**: AES-256
* **Service**: Google Cloud Storage with default encryption
* **Additional**: Server-side encryption enabled

### Backup Encryption

* **Database backups**: Encrypted with same keys
* **Retention**: Encrypted throughout lifecycle
* **Deletion**: Secure, cryptographic erasure

## Secret Encryption

Integration credentials receive additional protection:

### Organization Secrets

API keys, tokens, and credentials for integrations are encrypted with organization-specific keys:

```
Your API Key → AES-256 (org key) → Encrypted Storage
```

### Key Hierarchy

1. **Master key**: Stored in hardware security module (HSM)
2. **Organization key**: Derived from master key, unique per org
3. **Data encryption key**: Used to encrypt actual secrets

### Key Rotation

* Master keys rotated per security policy
* Organization keys can be rotated on request
* Automatic re-encryption during rotation

## Your Control

### Data Visibility

You can see what data Adapt has access to:

* Integration connections in Settings
* Data sources used in each query
* Stored secrets (names only, not values)

### Data Deletion

When you delete data:

* Immediately removed from active systems
* Purged from backups within 30 days
* Cryptographically unrecoverable

### Revoke Access

You can revoke integration access anytime:

1. Go to **Settings > Integrations**
2. Click the integration
3. Click **Disconnect**

Credentials are immediately deleted.

## Technical Details

### Algorithms

| Purpose | Algorithm |
| - | - |
| Symmetric encryption | AES-256-GCM |
| Key derivation | HKDF-SHA256 |
| Transport | TLS 1.3 |
| Hashing | SHA-256, bcrypt (passwords) |

### Infrastructure

* **Cloud provider**: Google Cloud Platform
* **Key management**: Google Cloud KMS
* **HSM**: FIPS 140-2 Level 3 certified
* **Region**: United States (configurable for enterprise)

## Questions?

For questions about our encryption practices:

* **Email**: [security@adapt.com](mailto:security@adapt.com)
* **Documentation**: Request our security whitepaper

> [card] [Security Overview](https://v1-docs.adapt.com/docs/security/overview.md)
>
> Complete security documentation

> [card] [SOC 2 Compliance](https://v1-docs.adapt.com/docs/security/soc2-compliance.md)
>
> Our compliance program


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.