Skip to content

Cryptography & Secrets Policy

Field Value
Status draft
Owner INFRA (application crypto) / OPS (secrets store, TLS at infra)
Applies to All cryptographic use and all secret material across backend, mobile, infra, and vendor integrations.
Review cadence Annual, or on any change to the secrets store, crypto primitives, or transport configuration.
Mapped controls SEC-01 (token hashing), SEC-05 (secret hygiene), SEC-08 (TLS in transit).
Evidence partile-infra: app/auth/tokens.py (SHA-256 token hashing), app/auth/service.py; partile-ops: infra/envs/prod-gcp/ Secret Manager and private-network configuration; readiness/threat-model-and-auth-review.md.
Exception handling Use of a non-standard primitive or an unencrypted transport is a dated, risk-accepted DIR decision.

Purpose

State how Partile uses cryptography and manages secrets, grounded in the backend's existing posture, so security does not depend on memory or luck.

Cryptography in use (current)

  • Session tokens: secrets.token_urlsafe(32) (256-bit), stored only as a SHA-256 hash; plaintext returned once, never persisted (SEC-01).
  • OAuth/handoff: random state and one-time handoff codes in Redis with short TTLs; the handoff key is SHA-256-keyed; tokens never placed in URLs (SEC-02/03).
  • Transport / network: client↔Cloudflare and Cloudflare↔Cloud Run are over HTTPS; Cloud Run reaches Cloud SQL over private IP/socket and Redis over the private VPC through the Serverless VPC Access connector. Managed data stores are not public (SEC-08).

Rules

  1. Use vetted primitives only — the platform's secrets, standard TLS, and well-reviewed libraries. No home-rolled crypto.
  2. Hash, don't store, authenticators. Secrets that only need verification (session tokens) are stored as hashes, never plaintext.
  3. Encrypt in transit and isolate managed data stores. TLS protects public edge/origin paths; production data stores use private GCP networking and provider-managed encryption at rest for managed services/backups.
  4. Strong, current configurations. TLS 1.2+; deprecated ciphers disabled.

Secrets management

  • Never in the repo, code, logs, or this data room. Access logs are off in the container so codes/state don't land in logs (SEC-05).
  • Stored in GCP Secret Manager / environment. Production secret payloads live in Secret Manager; plain non-secret config lives in Cloud Run env. Only safe labels (e.g. DATABASE_URL, RATE_LIMIT_*) appear in documentation; never values.
  • Least-privilege issuance of service credentials (access-control-policy.md).
  • Rotation: secrets are rotated on suspected exposure immediately, and on contributor offboarding (../procedures/onboarding-offboarding-procedure.md); a routine rotation cadence is established before real user data launches. Cloudflare token rotation is currently tracked as ACT-001.
  • Detection: the release-review rg scan blocks accidental secret commits; a committed secret is an incident (incident-response-policy.md) and is rotated.

Exceptions

Any deviation (e.g. a temporary non-TLS local dev path) is confined to local/dev, never production, and recorded by DIR. Production exceptions to encryption or secret-store rules are not permitted.