Encryption Key Management Policy

Purpose

This policy outlines the procedures and guidelines for managing encryption keys within our organization to ensure the confidentiality, integrity, and availability of our systems and data. This policy is designed to comply with SOC 2 requirements and industry best practices.

Scope

This policy applies to all encryption keys used within our organization, including but not limited to:

• TLS certificates
• Application-specific encryption keys (e.g., Laravel APP_KEY)

TLS Certificate Management

Certificate Authority

• Our TLS certificates are managed by Fly.io, which uses Let’s Encrypt as the Certificate Authority.

Certificate Renewal

• Let’s Encrypt certificates are automatically renewed by Fly.io before expiration.
• The renewal process is automated and does not require manual intervention.

Monitoring

• IT staff will monitor the Fly.io dashboard regularly to ensure proper functioning of the TLS certificate management system.
• Any issues with certificate renewal or expiration will be addressed immediately.

Laravel APP_KEY Management

Key Generation

• The Laravel APP_KEY is a 32-character random string used for all encrypted data.
• The key is generated using Laravel’s built-in key generation mechanism.

Key Storage

• The APP_KEY is stored in the Doppler secrets manager, and integrated with the Laravel application on VM bootup in the Fly environment.
• Access to environments within Doppler are restricted to authorized personnel only.

Key Rotation

• The APP_KEY will be rotated annually.
• The rotation process will be performed by a designated team member.

Rotation Procedure

1. Generate a new APP_KEY using Laravel’s artisan key:generate command, for each environment.
2. Update the Doppler environments with the new APP_KEY.
3. Deploy the changes to all environments (development, staging, production).
4. Verify that all systems are functioning correctly with the new key.
5. Securely delete the old key from all systems.

Emergency Key Rotation

• In case of a suspected key compromise, an emergency key rotation will be performed immediately following the same procedure as the regular rotation.

Application S3 Key Management

Key Generation & Usage

• The production application S3 key is a secret generated by the AWS UI.
• This key is used only by the Momentum application in the production environment.
• Separate keys exist for staging and development environments; these do not have access to production resources and are therefore not subject ot the same rotation requirements.,

Key Storage

• The key is deployed to the production environment using Doppler.
• Access to environments within Doppler are restricted to authorized personnel only.

Key Rotation

• The S3 production application key will be rotated annually.
• The rotation process will be performed by a designated team member.

Rotation Procedure

1. Generate a new keypair in the AWS IAM tool.
2. Update the production Doppler environment.
3. Deploy the change to production (automatic sync is triggered by Doppler).
4. Verify that all systems are functioning correctly with the new key.
5. Delete the old key in the AWS IAM tool.

Access Control

• Access to encryption keys and systems managing these keys is restricted to authorized personnel only.
• Access rights are reviewed quarterly and updated as needed.

Incident Response

• Any suspected or confirmed compromise of encryption keys must be reported immediately to the security team.
• The incident response plan will be activated, which may include emergency key rotation and system audits.

Compliance and Audit

• This policy and related procedures will be reviewed annually to ensure compliance with SOC 2 requirements and industry best practices.
• Regular audits will be conducted to verify adherence to this policy.

Training

• All personnel involved in the management of encryption keys will receive appropriate training on this policy and related procedures.

Policy Review

• This policy will be reviewed annually and updated as necessary to reflect changes in technology, business needs, or regulatory requirements.
• Last reviewed/updated: 2026-08-25