How we handle personal information

Every path between browser and server and between servers is encrypted. There is no plaintext communication path.

• ProtocolTLS 1.3 only · legacy versions and weak cipher suites are disabled entirely
• Cipher suitesAES-256-GCM or ChaCha20-Poly1305
• Key exchangeECDHE -based Perfect Forward Secrecy (PFS) — a new session key is created for every connection and destroyed when the session ends. Even if a server key is compromised later, past traffic cannot be decrypted.
• EnforcementHSTS preload automatic certificate renewal · plaintext HTTP connections blocked immediately
• Between serversMutual TLS (mTLS) — both sides must verify each other's certificate before a connection is allowed

Different data uses different encryption keys. Compromise of one does not expose the others.

• Content encryptionAES-256-GCM envelope encryption — a separate data encryption key (DEK) is generated for each record
• Key protectionData keys are wrapped again with a key-encryption key (KEK), and the master key exists only inside an HSM(hardware security module). The key itself cannot be extracted.
• Key rotationMaster keys are rotated automatically on a regular schedule, and a new data key is generated each time. Encrypting the same value twice produces a different result every time.
• PasswordsArgon2id one-way hash — the original password cannot be recovered from the stored value
• SearchBlind index (HMAC-SHA-256) — query data without storing plaintext
• BackupsBackups are encrypted the same way and their keys are stored separately

Personal information is not stored on internet-facing service servers. It is stored only on a separate server that cannot be reached directly from the internet.

• LocationA private-only network with no public IP — there is no external connection path at all
• InboundOnly preregistered services that prove identity with an mTLS certificate can connect
• OutboundDefault deny — it cannot communicate with any server not on the allowlist. This blocks data-exfiltration paths at the source.
• PermissionsEach service account receives only the minimum required permissions · fields outside the required scope cannot be queried
• Administrator accessOnly through a management path protected by fixed IP and multi-factor authentication · every session is recorded and logged

We record who viewed what and when, and when unusual activity appears, the system stops it before a person needs to intervene.

• Access logsEvery view · edit · download is logged and sealed with a hash chain so records are tamper-proof.
• Regular reviewsIncluding authenticated in-house platforms, all access logs are reviewed periodically.
• Bulk accessIf views · edits · downloads exceed a defined threshold, access is blocked automatically and immediately, and the administrator is alerted
• Anomalous patternsSessions are terminated when access occurs at unusual times, locations, or speeds
• RetentionAccess logs are kept for at least the statutory period and duplicated in separate storage