Cryptographic Policy¶

Purpose. Define which cryptography Soon uses to protect customer and company data, and how keys are managed. Soon relies on cloud-managed cryptography (AWS) rather than operating its own crypto infrastructure.

1. Scope¶

All Soon systems handling customer or company data: the SaaS product, AWS infrastructure, and supporting platforms (Netlify).

2. Policy¶

2.1 Encryption in transit¶

All traffic must use TLS 1.2 or higher (TLS 1.3 preferred). Legacy protocols (SSL, TLS 1.0/1.1) must be disabled on all endpoints.

2.2 Encryption at rest¶

All production data stores (databases, object storage, backups) must be encrypted at rest with AES-256, using AWS-managed encryption.

2.3 Key management¶

Encryption keys are managed in AWS KMS: keys must have automatic rotation enabled where supported, and key policies must restrict use and administration to least-privilege roles.
Keys must never be exported, hardcoded, or stored in source control. Application secrets follow the Secure Development Policy.

2.4 Approved algorithms¶

Use	Approved
Symmetric encryption	AES-256
Transport security	TLS 1.2+ / TLS 1.3
Asymmetric / signatures	RSA-2048 or stronger, or ECDSA
Password hashing	bcrypt, cost factor 10 — verified in the product source 2026-08-22 (`soon-server`: `src/models/team.js`, `src/model/user.js`). Argon2id is the preferred choice for any new implementation; raising the bcrypt cost factor to 12 is a recommended improvement, tracked as a normal change.

Deprecated algorithms (MD5, SHA-1 for signatures, DES/3DES, RC4) must not be used. New algorithm choices require approval by the security responsible.

2.5 Certificates¶

TLS certificates must be issued and renewed via managed services with automatic renewal: Cloudflare-managed certificates for the front end and website (confirmed 2026-08-22), and AWS Certificate Manager where an endpoint terminates TLS inside AWS. Manually issued certificates are not permitted.
Expired or self-signed certificates must not be used on production endpoints.

3. Roles & responsibilities¶

Engineering team: configures encryption and TLS per this policy.
Security responsible: approves algorithm choices and exceptions; reviews KMS key policies periodically.
AWS (shared responsibility): physical protection of key material in KMS.

Change log¶

Version	Date	Author	Comments
0.1	2023-10-23	Olaf Jacobson	First draft document
0.2	2026-07-18	Andrea Cardinali	Rewritten lean and Soon-specific (ISMS overhaul); fixed password-hashing standard (was MD5)