# Encryption Standard

# Encryption Standard

*Adapted from GitLab's Encryption Policy.*

## In transit

- Every NFE web service (Nextcloud, BookStack, ERPNext, webmail) uses **HTTPS with TLS 1.2+**. Plain HTTP only redirects to HTTPS.
- Mail clients connect with TLS (IMAPS 993, SMTP submission 587 with STARTTLS or 465). Never with plain-text auth.
- Field devices report over encrypted channels: TLS for MQTT, a VPN or tunnel (WireGuard/Tailscale) for remote admin. Modbus/TCP has no encryption, so it must **stay on local networks** or inside a tunnel.

## At rest

- Laptops: full-disk encryption on (FileVault / BitLocker / LUKS).
- Phones: device encryption with a screen lock (the default on modern phones).
- USB drives and backups holding NFE data: encrypted.
- Server disks and backups: encrypted by the host. Confirm with Federated Computer.

## Secrets

- Passwords, API keys, tokens and private keys are kept in a password manager or the system's own secret store. **Never** in Library pages, Deck cards, chat, email, code repositories or unencrypted files.
- Rotate a secret straight away if it may have been exposed; see [Leaked Credentials Runbook](https://bookstack.nearlyfreeenergy.com/books/security/page/leaked-credentials-runbook).
- Use modern algorithms: RSA ≥ 2048 or Ed25519 for keys; never MD5 or SHA-1 for security purposes.