---
title: Data encryption
category: security
order: 3
lastUpdated: 2026-06-08
featureAvailability: GA
roles: [admin, district-admin]
relatedArticles: [security/access-controls, procurement/security-overview, security/incident-response]
---

## At a glance

- **Purpose:** Document encryption at rest, in transit, and for sensitive credentials.

## In transit

- **TLS 1.2 or higher** on every connection.
- **HSTS** enabled with preload eligibility.
- **Certificate management:** automated via the platform's managed CDN; no manual renewal required.

Public intake forms, the authenticated app, the API surface, and integration callbacks all enforce TLS. There is no plaintext fallback.

## At rest

- **Primary database:** AES-256 storage-layer encryption with managed keys.
- **Object storage** (uploads, exports, dossier ZIPs): AES-256 storage-layer encryption with managed keys.
- **Backups:** Encrypted with the same algorithm; backup keys are distinct from primary keys.

## Application-level encryption

Some categories of data are encrypted a second time at the application layer before being written to the database, so that even an operator with database access cannot read them in plaintext:

- LMS access tokens (Canvas, Google Classroom).
- SAML signing material and IdP metadata.
- Stripe billing identifiers (where retained).
- Any field in our `secrets` store.

## Key management

- All keys are managed by AmplifyED's KMS.
- Customer-managed keys (BYOK) are not supported today.
- Key rotation runs on a scheduled cadence; encrypted data is automatically re-encrypted under the new active key.

## Email content

Outbound email (notifications, invitations, scheduled exports) is delivered via our transactional email subprocessor over TLS. Email content is encrypted in transit but, like all email, is not end-to-end encrypted. Treat outbound email as a notification surface, not a record surface — the record lives inside AmplifyED.

## Related articles

- [Access controls](/help/security/access-controls)
- [Security overview](/help/procurement/security-overview)
- [Incident response](/help/security/incident-response)

## FAQ

**Do you support customer-managed encryption keys?**
Not today. We can speak to your KMS expectations during onboarding for districts with strict requirements.

**Are passwords stored?**
Passwords are bcrypt-hashed; the plaintext is never stored.