PR.DS-2: Data-in-transit protection

Requirement

This control is covered by other elements of the framework; no additional requirements are identified.

Our Implementation

All data in transit is protected with TLS 1.2 or higher. HTTPS is enforced on all web applications and API endpoints — unencrypted HTTP connections are automatically redirected. Inter-service communication between cloud providers (e.g., Vercel to Supabase, Modal to Qdrant) uses TLS-encrypted connections.

API authentication uses JWT tokens issued by Supabase Auth, ensuring that all API requests are both encrypted and authenticated. Supabase database connections use SSL/TLS encryption.

Gaps / Planned improvements:

• No certificate pinning implemented — relying on standard TLS certificate validation (NEX-379)

Evidence

• Cloud Infrastructure