Data Encryption
What it does
All data is encrypted at rest (AES-256) and in transit (TLS 1.3). API keys are stored as SHA-256 hashes — plaintext keys are never persisted. Database connections use SSL, and backups are encrypted with separate key management.
How to use it
Use HTTPS only
All API requests must use HTTPS. HTTP requests are automatically redirected to HTTPS.
Verify TLS
POTAL enforces TLS 1.2+ on all connections. Check your client supports modern TLS versions.
Protect API keys
Store API keys in environment variables or secret managers — never in source code or client-side code.
Request data deletion
Under GDPR, request deletion of all stored data including encrypted backups.
Related Features
Granular API key scopes with row-level security enforcement
CSP, HSTS, X-Frame-Options, and OWASP-compliant headers
Full multi-tenancy with row-level security data isolation
Secure API key authentication with scope-based permissions
Full GDPR compliance with data export and deletion rights