Data encryption

At a glance

Purpose: Document encryption at rest, in transit, and for sensitive credentials.

In transit

TLS 1.2 or higher on every connection.
HSTS enabled with preload eligibility.
Certificate management: automated via the platform's managed CDN; no manual renewal required.

Public intake forms, the authenticated app, the API surface, and integration callbacks all enforce TLS. There is no plaintext fallback.

At rest

Primary database: AES-256 storage-layer encryption with managed keys.
Object storage (uploads, exports, dossier ZIPs): AES-256 storage-layer encryption with managed keys.
Backups: Encrypted with the same algorithm; backup keys are distinct from primary keys.

Application-level encryption

Some categories of data are encrypted a second time at the application layer before being written to the database, so that even an operator with database access cannot read them in plaintext:

LMS access tokens (Canvas, Google Classroom).
SAML signing material and IdP metadata.
Stripe billing identifiers (where retained).
Any field in our secrets store.

Key management

All keys are managed by AmplifyED's KMS.
Customer-managed keys (BYOK) are not supported today.
Key rotation runs on a scheduled cadence; encrypted data is automatically re-encrypted under the new active key.

Email content

Outbound email (notifications, invitations, scheduled exports) is delivered via our transactional email subprocessor over TLS. Email content is encrypted in transit but, like all email, is not end-to-end encrypted. Treat outbound email as a notification surface, not a record surface — the record lives inside AmplifyED.

FAQ

Do you support customer-managed encryption keys? Not today. We can speak to your KMS expectations during onboarding for districts with strict requirements.

Are passwords stored? Passwords are bcrypt-hashed; the plaintext is never stored.