Data Encryption at Rest

Source code is intellectual property. CodeDD encrypts files at rest throughout audit processing and deletes them securely when the audit completes.

Protection layers#

In transit — all client and API traffic over HTTPS with modern TLS.

At rest — files encrypted in the audit cache immediately after indexing using Fernet symmetric encryption (AES-128-CBC + HMAC-SHA256). Authenticated tokens prevent tampering.

In memory — plaintext exists only transiently during analysis and is cleared afterward.

Key management#

Encryption uses an installation-wide key with rotation support:

ENCRYPTION_KEY           — active key (required)
PREVIOUS_ENCRYPTION_KEYS — prior keys for rotation (comma-separated)

During rotation, older files decrypt with previous keys and re-encrypt with the active key on next access.

Timeline#

Clone / scope confirm
  → File discovered and metrics calculated
  → File encrypted in audit cache
  → Plaintext purged from memory
  → Decrypted in memory only during analysis
  → Securely wiped after audit completion

Credential storage#

• Git OAuth tokens and PATs — encrypted at rest
• CLI tokens — OS credential manager (Windows Credential Locker, macOS Keychain, Linux Secret Service)
• LLM API keys — keychain only (CLI); never in config files

Database and metadata#

Findings, scores, file paths, and LOC metrics are stored in the database. No source file content is persisted.

Hosting#

Primary processing infrastructure is hosted in IONOS data centers in Germany. See Compliance & Certifications.

Compliance alignment#

Encryption controls align with GDPR, SOC 2, and ISO 27001 requirements. Certification attestations are in progress.

Next steps#

• Secure Data Deletion
• Compliance & Certifications
• Repository Connection & Security