---
title: Data Encryption at Rest
description: How CodeDD protects your source code during audit processing
category: Security & Privacy
order: 1
---

# Data Encryption at Rest

Source code is intellectual property. CodeDD encrypts files at rest throughout audit processing and deletes them securely when the audit completes.

## Protection layers

**In transit** — all client and API traffic over HTTPS with modern TLS.

**At rest** — files encrypted in the audit cache immediately after indexing using **Fernet** symmetric encryption (AES-128-CBC + HMAC-SHA256). Authenticated tokens prevent tampering.

**In memory** — plaintext exists only transiently during analysis and is cleared afterward.

## Key management

Encryption uses an installation-wide key with rotation support:

```
ENCRYPTION_KEY           — active key (required)
PREVIOUS_ENCRYPTION_KEYS — prior keys for rotation (comma-separated)
```

During rotation, older files decrypt with previous keys and re-encrypt with the active key on next access.

## Timeline

```
Clone / scope confirm
  → File discovered and metrics calculated
  → File encrypted in audit cache
  → Plaintext purged from memory
  → Decrypted in memory only during analysis
  → Securely wiped after audit completion
```

## Credential storage

- Git OAuth tokens and PATs — encrypted at rest
- CLI tokens — OS credential manager (Windows Credential Locker, macOS Keychain, Linux Secret Service)
- LLM API keys — keychain only (CLI); never in config files

## Database and metadata

Findings, scores, file paths, and LOC metrics are stored in the database. **No source file content** is persisted.

## Hosting

Primary processing infrastructure is hosted in **IONOS data centers in Germany**. See [Compliance & Certifications](/documentation/compliance-certifications).

## Compliance alignment

Encryption controls align with GDPR, SOC 2, and ISO 27001 requirements. Certification attestations are in progress.

## Next steps

- [Secure Data Deletion](/documentation/secure-data-deletion)
- [Compliance & Certifications](/documentation/compliance-certifications)
- [Repository Connection & Security](/documentation/repository-connection-security)