Skip to main content
Essal applies strong encryption at every layer — from data in transit between clients and the API, to data at rest in storage and database systems.

​
Encryption in Transit

All communication between clients and the Essal API is encrypted using TLS 1.2 or TLS 1.3. Older protocols (TLS 1.0, 1.1, SSLv3) are not supported and connections using them are rejected. API endpoints enforce HTTPS. HTTP connections are redirected to HTTPS automatically.

​
Encryption at Rest

All persistent data — documents, files, user records, audit logs, CRM data — is encrypted at rest using AES-256.

​
Key Management

Encryption keys are managed through a dedicated key management service (KMS). Keys are:
  • Rotated automatically every 90 days
  • Never stored alongside the data they protect
  • Accessible only to the encryption service; not to application code

​
Customer-Managed Keys (Enterprise)

Enterprise workspaces can provide their own encryption keys (BYOK — Bring Your Own Key). Your key is stored in your cloud provider’s KMS (AWS KMS, Azure Key Vault, or GCP Cloud KMS) and Essal never holds it directly. If you revoke the key, access to encrypted data is immediately blocked. Contact security@essal.cloud to enable BYOK for your workspace.

​
Secrets Handling

API keys and webhook secrets are stored as one-way hashes. Essal cannot recover a lost API key — you must rotate it and issue a new one.

​
TLS Certificate

Essal uses certificates issued by a globally trusted CA. Certificate transparency logs are monitored for unauthorised issuance. Pinning is not required or recommended.