PR.DS-1: Data-at-rest protection

Requirement

This control is covered by other elements of the framework; no additional requirements are identified.

Our Implementation

All data at rest is encrypted at the infrastructure level by cloud providers. The primary database (Supabase, hosted on AWS eu-central-1) uses AES-256 encryption for data at rest, with encryption keys managed by AWS Key Management Service (KMS). Other database providers (Turso, Qdrant, Upstash) similarly encrypt stored data using their platform-managed encryption.

Source code repositories on GitHub are stored on encrypted infrastructure. File storage via Supabase Storage uses the same AES-256 encryption as the database layer.

Gaps / Planned improvements:

• Application-level encryption deferred to provider-managed KMS — risk assessed and accepted per RSK-005 with CTO approval
• Full-disk encryption not yet verified on all team member devices (NEX-345)

Evidence

• Cloud Infrastructure
• Risk Register