Encryption

Encryption behaviour as implemented:

• In transit — TLS 1.2 or higher for the website and API, with HSTS. Database connections use TLS (`sslmode=require`), which encrypts the connection without verifying the server certificate; `verify-full` is a stronger option the operator can configure.
• Passwords — salted one-way hashing; plaintext passwords are never stored or logged.
• Tokens and identifiers — session tokens are signed (not encrypted at the application layer); deployment and SCIM tokens are stored as one-way hashes; analytics IP, session, and device identifiers are stored as salted hashes.
• At rest — encrypted by the hosting and database providers under their plans; this is plan-dependent and must be confirmed for the chosen plan. Fortaify does not claim application-level field encryption; if that is required, it must be scoped and implemented as an engineering project.

Self-hosted customers control their own TLS certificates, database encryption, and key management. The shipped mobile client permits cleartext HTTP only for loopback/private-LAN connections by design; deployments that cannot accept that exception must terminate TLS with a trusted certificate, and the client itself should be verified for your deployment.