Encryption at Rest
Managed encryption at all levels: Postgres, S3, Redis, CloudWatch Logs
Principle
All data stored on the SSM.ro platform is encrypted at rest through the cloud providers' managed services. There are no unencrypted storage components.
Encryption per Component
Storage mechanisms differ between the two deployment models, but in both cases all data is encrypted at rest through managed services.
Shared Model (SaaS)
Shared Model (SaaS)
The multi-tenant infrastructure runs on Heroku (Postgres, Key-Value Store) and AWS S3.
| Component | Encryption Mechanism | Key Management |
|---|---|---|
| Heroku Postgres | Encryption at rest provided by Heroku (based on AWS RDS); enabled automatically on all plans | Managed by Heroku/AWS |
| Heroku Redis (Key-Value Store) | Encryption at rest provided by Heroku | Managed by Heroku |
| Heroku Postgres backups | Encrypted at rest; stored within the Heroku platform | Managed by Heroku |
| AWS S3 — Primary bucket | Server-Side Encryption (SSE); enabled on the entire bucket | Managed by AWS (SSE-S3) |
| AWS S3 — CRR Replica | Server-Side Encryption (SSE); identical to the primary bucket | Managed by AWS |
| AWS CloudWatch Logs | Encryption at rest; enabled at the log group level | Managed by AWS |
Enterprise Model (Dedicated)
Enterprise Model (Dedicated)
The dedicated per-client infrastructure runs directly on AWS: Postgres on AWS RDS, Redis on AWS ElastiCache, without the intermediate Heroku layer.
| Component | Encryption Mechanism | Key Management |
|---|---|---|
| AWS RDS Postgres | Encryption at rest via AWS RDS (AES-256); enabled at the instance level | Managed by AWS KMS |
| AWS ElastiCache (Redis) | Encryption at rest via ElastiCache | Managed by AWS KMS |
| RDS backups / snapshots | Snapshots encrypted automatically (inherit instance encryption) | Managed by AWS KMS |
| AWS S3 — Primary bucket | Server-Side Encryption (SSE); enabled on the entire bucket | Managed by AWS (SSE-S3) |
| AWS S3 — CRR Replica | Server-Side Encryption (SSE); identical to the primary bucket | Managed by AWS |
| AWS CloudWatch Logs | Encryption at rest; enabled at the log group level | Managed by AWS |
Encryption Key Management
Encryption at rest is fully managed by the managed cloud providers (Heroku/AWS), in both the Shared Model and the Dedicated Model. Keys are created, stored, and rotated automatically by the provider through AWS KMS, without manual intervention.
SSM.ro does not offer a Bring Your Own Key (BYOK) option — managed encryption ensures data security without the operational complexity and availability risks associated with the client managing its own keys.
Backup Retention and Limits
Shared Model (SaaS)
The platform uses the Heroku Postgres Standard plan, which retains up to 25 manual backups.
In addition to manual backups, Continuous Protection (PITR) is enabled: any change made to the database is continuously and automatically backed up, allowing restoration to a specific point in time.
Enterprise Model (Dedicated)
In the dedicated AWS infrastructure, backups are provided through automated AWS RDS snapshots and Continuous Backups / PITR, with a configurable retention window per client. Snapshots are automatically encrypted and stored in AWS.
S3 Versioning and Lifecycle
The primary S3 bucket is configured with:
- Versioning enabled — protection against accidental deletion or overwriting
- Lifecycle rule
expire-deleted-objects— non-current versions are retained for a maximum of 100 days, after which they are permanently deleted (0 non-current versions are retained indefinitely) - Block Public Access enabled on the entire bucket