Skip to content
XEVRION
Get started
Menu
ProductOverviewReviewProveControlObserveImproveHow it works
TeamsEngineeringSecurityComplianceOperations
CompanyAboutContactChangelogSecurity
ResourcesDocsGlossaryFAQPricingPrivacy

Control

Lock stored data, with a key you can pull

Turn on encryption for stored review data. Enterprise can hold the key in a service you run.

Get startedSee pricing →
app.xevrion.co.uk / settings / encryptionExample data

Encryption at rest

Review data
Status
On
Data key
Own key for your organisation
Algorithm
AES-256-GCM
Key held by
Your key service (Enterprise)

Wrap, store, read

  1. Fresh data key per organisation
  2. Key wrapped by your key
  3. Payloads stored encrypted
  4. Destroy the key to erase

Stored value

payload: enc1.k_4f2e.7a9f…c2.0d41…e9b6// prefix, key id, nonce, ciphertext// opened only with your key

Why it matters

What encryption and your own key changes

  • Stored review data is encrypted.
  • On Enterprise, the key sits in a service you run.
  • Revoke the key and we can no longer read the data.
  • Stored review data is readable by your vendor.
  • You have no way to cut off access.
  • Deleting means trusting a promise.

The resultYou hold the switch.

What you get

Encryption and your own key, in practice

  • Own data key

    Each organisation gets its own key. Requests, events, replies and attachments are sealed.

  • Your key, if you want it

    A key service you run can lock the data key. Revoke it and access stops.

  • Destroy to erase

    Destroying the keys makes the sealed data unreadable.

How it works

Step by step

  1. 1

    Switch on

    An owner turns encryption on.

  2. 2

    Data key made

    One per organisation, locked by a master key or yours.

  3. 3

    Data sealed

    Before it is stored.

  4. 4

    Rotate or revoke

    Rotate any time. Revoke to cut access.

Questions

About encryption and your own key

Is it instant everywhere after revoking?

Servers can hold a key in memory for a short time, up to about a minute, so cut-off is fast but not instant.

Are old records encrypted too?

New writes are sealed. Older records are sealed the next time they are saved.

Next

Works well with

Know what your agents did.

Start free. Guard your first agent in a few minutes, and keep a record anyone can check.

Get started freeSee pricing →
  • Free plan, no card
  • Signed, chained decisions
  • Checked offline, without us