Data protection
Crusoe AI Platform employs industry-standard encryption protocols and data protection controls across stored assets and network transit paths.
Encryption matrix
| Asset / Service | Location | Encryption at Rest | Encryption in Transit |
|---|---|---|---|
| Secret Values | Dedicated Secret Store | AES-256 Encrypted Store | TLS 1.3 / HTTPS |
| Published APIs | API Gateway Edge | Encrypted Storage | TLS 1.3 / HTTPS (Automated Certificates) |
| MemoryStore | Managed Storage Volumes | Encrypted Volume Storage | TLS 1.3 (rediss://) on External Endpoints |
| VectorDB | Managed Vector Indexes | Encrypted Volume Storage | TLS 1.3 / HTTPS |
| Pub/Sub Messages | Managed Message Storage | Encrypted Volume Storage | TLS 1.3 / HTTPS |
| Agent Source Code | Platform Repository | Encrypted Storage | TLS 1.3 / HTTPS |
| Audit Logs | Immutable Audit Store | Encrypted Storage | TLS 1.3 / HTTPS |
Encryption at rest
Dedicated Secret Store
Secret values stored via Secrets Manager are held in a dedicated AES-256 store. It starts sealed and serves nothing until it is unsealed.
Where the unseal key lives is an install decision, and it is the weakest link in this chain. The default install splits the unseal key into Shamir shares and keeps them on the platform, next to the store itself, so the store can re-open automatically after a restart — which also means platform-level access to that storage is enough to re-open it. A production install should delegate unsealing to an external KMS or transit seal instead (autoUnseal): initialization then writes no unseal key anywhere on the platform, and the key material never leaves the KMS.
Secret values are never returned in standard listing or metadata inspection APIs. Revealing raw secret values requires explicit administrative break-glass authorization and writes an immutable entry to the project audit log.
Storage Volume Encryption
Database instances, vector storage indexes, and messaging volumes run on encrypted managed storage volumes protected by standard block-level encryption.
Encryption in transit
External HTTPS Traffic
All external endpoints published via API Gateway (*.apps.codyhill.dev or custom domains) enforce TLS 1.3 encryption in transit. Automated certificate management issues and renews TLS certificates without downtime or manual configuration.
Internal Network Security
Internal project workloads communicate over isolated project networks protected by strict tenant isolation rules, IP allowlists, and mutual identity verification.
Log retention & audit trails
- Application Logs: Agent and function console logs are retained for 14 days by default. Logs can be streamed real-time or exported via
platformctl logs. - Audit Trails: Administrative audit events (
project.secret.reveal,apikey.create,project.member.add) are stored permanently in an append-only audit log.
Compliance and administrative isolation
Platform administrative roles use code-enforced isolation: platform administrators cannot inspect project secret values or source assets without executing explicit, time-bound break-glass procedures visible to customer project admins.