Encryption Standard

Encryption Standard

Adapted from GitLab's Encryption Policy.

In transit

• Every NFE web service (Nextcloud, BookStack, ERPNext, webmail) uses HTTPS with TLS 1.2+. Plain HTTP only redirects to HTTPS.
• Mail clients connect with TLS (IMAPS 993, SMTP submission 587 with STARTTLS or 465). Never with plain-text auth.
• Field devices report over encrypted channels: TLS for MQTT, a VPN or tunnel (WireGuard/Tailscale) for remote admin. Modbus/TCP has no encryption, so it must stay on local networks or inside a tunnel.

At rest

• Laptops: full-disk encryption on (FileVault / BitLocker / LUKS).
• Phones: device encryption with a screen lock (the default on modern phones).
• USB drives and backups holding NFE data: encrypted.
• Server disks and backups: encrypted by the host. Confirm with Federated Computer.

Secrets

• Passwords, API keys, tokens and private keys are kept in a password manager or the system's own secret store. Never in Library pages, Deck cards, chat, email, code repositories or unencrypted files.
• Rotate a secret straight away if it may have been exposed; see Leaked Credentials Runbook.
• Use modern algorithms: RSA ≥ 2048 or Ed25519 for keys; never MD5 or SHA-1 for security purposes.