LIB-SEC-002 — How is data encrypted in transit?

TLS 1.3 is enforced on all endpoints; TLS 1.2 is the absolute minimum and only permitted for clients that cannot negotiate 1.3. We use ECDHE key exchange with forward secrecy and modern AEAD cipher suites only. Internal service-to-service traffic uses mTLS with short-lived certificates issued by an internal CA.

Source: Transport security

Category

Security

Status

Approved

Freshness

Fresh

Freshness policy

12 months

Last reviewed

Mar 16, 2026

Author

Rachel Murphy

Reuse count

3

Times drafted from

1