— SECURITY · 03 OF 07 · CRYPTO

AES-256-GCM at rest. TLS 1.3 in transit. Per-customer key. Always.

No legacy ciphers. No optional fallbacks. No “encryption coming soon”. Every byte at rest is encrypted with a key generated by your VM, kept in your VM, destroyed with your VM. Aliens engineers cannot read your data without your real-time approval.

AT RESTAES-256-GCM
IN TRANSITTLS 1.3 minimum
KEY MANAGEMENTvTPM-backed KEK
ROTATIONQuarterly + on-demand

01Algorithms summary.

Layer
Algorithm
Key length
Disk encryption
AES-256-GCM (authenticated)
256-bit DEK
Key wrapping
AES-256-GCM (KEK wraps DEK)
256-bit KEK
TLS
TLS 1.3 only (no 1.2 fallback for new connections)
P-256 / X25519
Inter-service
mTLS with rotated client certs
RSA-3072 / ECDSA P-256
Hashing (passwords)
Argon2id (m=128 MiB, t=4, p=4)
n/a
Hashing (audit)
SHA-256 (HMAC for log integrity)
256-bit HMAC key
Random
OS CSPRNG (getrandom(2))
256-bit seed

02Key lifecycle.

  • Generation: on first VM boot, the vTPM generates a fresh 256-bit KEK. Generation entropy comes from the host CPU’s hardware RNG, mixed with VM-local entropy sources. The KEK is unique to your VM.
  • Storage: KEK lives only inside the vTPM. It cannot be exported in plaintext. DEKs are wrapped under it.
  • Rotation: automatic quarterly rotation. Customer-initiated rotation available via dashboard at any time. Rotation is online — no downtime; old DEKs decrypt-only, new DEKs for new writes, re-wrap on next access.
  • Destruction: on contract end + 7-day cooling-off, the vTPM securely zeroises the KEK. Without KEK, every disk byte becomes ciphertext with no path to plaintext.
  • Aliens access: Aliens engineers cannot retrieve a KEK. Break-glass mode allows live read-only access to a VM, but the VM mediates — engineers see plaintext only for the duration of the approved session, and only with the customer’s explicit, real-time go-ahead.

03TLS policy.

All inbound traffic to *.anilcyborg.com requires TLS 1.3. We do not accept TLS 1.0/1.1; TLS 1.2 only for legacy customer-side webhook callers under explicit per-tenant exception, with an exit ramp.

  • HSTS preloaded (max-age=63072000; includeSubDomains; preload).
  • Cipher suites limited to AEAD: AES-128-GCM, AES-256-GCM, ChaCha20-Poly1305.
  • Forward secrecy mandatory (ECDHE only).
  • OCSP stapling on. Certificate Transparency logged.
  • Certificate authority: Let’s Encrypt (production) + DigiCert (enterprise).
  • Annual review · https://securityheaders.com A+ baseline.

04Inference traffic.

Inference calls between your VM and the foundation-model providers traverse mTLS-protected channels. Provider-side, contracts mandate zero retention of prompts or completions. The DPA sub-processor table is the source of truth on which providers are allowed.

05What we don’t do.

  • No customer-managed-key (CMK) custody illusion. Some vendors call vault-stored single-tenant keys “customer-managed” while still holding them. We don’t. KEKs live in your VM’s vTPM — period. (BYOK is on the roadmap for enterprise; not P0.)
  • No quantum-resistant algorithms yet. NIST PQC standards are recent (2024). We’ll migrate when the algorithm + library ecosystem is mature. Roadmap target: 2027.
  • No DRM-style obfuscation. If you have access to your VM, you have access to your data. We don’t hide it from you with weird wrappers.