Encryption Policy
1. Purpose
This policy states the encryption and cryptographic standards Fueling Agile uses to protect data in transit, at rest where implemented, and for passwords and secrets. We only claim controls that exist in production.
2. Scope
Applies to public websites, APIs, databases, backups, and secrets used to run AgileFlex / FANMS (admin: fantech.*, company: fleetos.*), including production and test environments we operate.
3. Required standards
| Layer | Required standard | How it is enforced |
|---|---|---|
| Public websites and APIs | HTTPS only. TLS 1.2 or newer. | Caddy reverse proxy terminates TLS. The API is not published on a public host port. |
| Passwords | One-way hash, never stored in plaintext. | BCrypt via the application password hasher. |
| Application secrets | Stored outside source control. | Deployment environment configuration / secrets. |
| Database connections | Encrypted transport where the engine and host support it. | Connection strings and host TLS settings. |
| Weak / forbidden crypto | Must not be used for new work. | No MD5 or SHA-1 for password storage. No TLS 1.0 or 1.1 for public sites. No homemade ciphers. |
4. Encryption in transit
- All customer and staff traffic to public hostnames must use HTTPS.
- TLS is terminated at the edge reverse proxy (Caddy). Minimum protocol is TLS 1.2.
- HTTP on legacy hostnames, if still present, must redirect to HTTPS.
- The application API listens on the private Docker network, not as a public internet port.
5. Encryption at rest — what we claim today
| Control | Status |
|---|---|
| Password hashing (BCrypt) | In production |
| Secrets kept out of git | In production |
| Application-level encryption of every database field / all PII | Not claimed |
| Customer-managed keys / HSM | Not claimed |
| Full-disk / volume encryption of the production host | Only if verified on the host and recorded internally |
6. Key and secret handling
- Production secrets are unique per environment (test vs production).
- Secrets are rotated after suspected compromise, after a privileged staff departure, or during policy review if warranted.
- Encryption keys and passwords must not be pasted into tickets, chat, or source control.
- Access to production secrets is limited to operators who need them to run the service.
7. Enforcement
HTTPS / TLS at Caddy, BCrypt password hashing, and role-based access. Questionnaire answers must match section 5.