Encryption in Transit
TLS 1.2+ enforced on all connections; Let's Encrypt, HSTS; mTLS or API token for the electronic signature provider
Principle
All traffic — inbound and outbound — for the SSM.ro platform is encrypted in transit. There are no unsecured HTTP communication channels.
External Connections (Inbound)
| Connection | Protocol | Certificates |
|---|---|---|
| Users → Heroku Router | HTTPS / TLS 1.2+ | Wildcard Let's Encrypt (managed by the technical support team) |
| HSTS | Strict-Transport-Security header enabled via the secure_headers gem | — |
config.force_ssl = true | All HTTP requests are redirected to HTTPS in production and staging | — |
Internal Heroku Connections
| Connection | Protocol | Network |
|---|---|---|
| Web dyno ↔ Heroku Postgres | TLS in transit | Heroku private network |
| Web dyno ↔ Heroku Redis | TLS in transit | Heroku private network |
| Worker dyno ↔ Heroku Redis | TLS in transit | Heroku private network |
Internal traffic is confined to the Heroku private network and does not traverse the public internet.
Outbound Connections to External Services
| Destination | Protocol | Authentication |
|---|---|---|
| AWS API Gateway | HTTPS | Gateway-level authentication (IAM) |
| AWS S3 | HTTPS (authenticated) | Least-privilege AWS credentials |
| AWS CloudWatch Logs | HTTPS | AWS IAM-scoped credentials |
| Electronic Signature Provider | HTTPS + mTLS (client certificate) or API token | Depends on the provider and configuration |
| Postmark | HTTPS | Dedicated server token per environment (Shared Model) |
| AWS SES | HTTPS | AWS IAM-scoped credentials (Dedicated Model) |
| New Relic | HTTPS | Per-account key |
| Sentry | HTTPS | Per-project DSN |
| Federated IdP (client) | HTTPS | Standard OIDC (Shared) / SAML 2.0 (Enterprise) |
Electronic Signature Provider — Authentication
Communication with the electronic signature provider takes place over HTTPS, with two possible authentication methods depending on the provider and configuration:
- mTLS (mutual TLS) — both the server and the client (the SSM.ro application) authenticate each other via certificates; this guarantees that only the application holding the valid client certificate can request a signature
- API token — a dedicated token per environment/integration, transmitted in a secured HTTPS header
Backup Restoration — Important Note
When restoring a Heroku Postgres backup, an HTTPS URL is always used to ensure that data remains encrypted in transit. Restoration via HTTP is not supported by Heroku.
TLS Certificate Management
Shared Model (SaaS)
Certificates from the Heroku Router are wildcard Let's Encrypt certificates, managed (issued and renewed) by the SSM.ro technical support team, not by Heroku ACM. The team monitors expiration and renews certificates ahead of time, uploading them to Heroku.
Enterprise Model (Dedicated)
In the per-client dedicated AWS infrastructure, TLS certificates are managed entirely by AWS (AWS Certificate Manager), with automatic issuance and renewal.