Cryptographic Key Management

Application Secrets

All secrets and credentials of the SSM.ro application are stored exclusively in Heroku config vars (application-level environment variables in Heroku):

• Not included in the source code or in the GitHub repository
• Access is restricted per environment (production vs. staging have separate sets)
• Mandatory 2FA on accounts with access to administrative consoles: GitHub, Heroku, AWS, and other consoles

Secrets include: database credentials, API tokens (Postmark, electronic signature provider, New Relic, Sentry), AWS keys, the cryptographic session key.

---

Electronic Signature Keys

The SSM.ro platform does not generate, store, or manage users' private signature keys. Document signing is carried out exclusively through remote electronic signature, delegated to an external qualified trust service provider (QTSP, eIDAS).

Key Custody Model

• Private signature keys and digital certificates are created, stored, and protected by the QTSP provider, within its certified infrastructure (HSMs under QTSP control).
• Cryptographic signing operations take place inside the provider's infrastructure — private keys never leave the QTSP environment and are never exposed to the SSM.ro platform.
• The platform transmits to the provider, via HTTPS (mTLS or API token), typically only the document hash; certain providers require the full document to be transmitted. The provider returns the digital signature, which is embedded into the PDF document on the platform.

Security Implications

• Reduced attack surface: a compromise of the SSM.ro infrastructure does not expose signature keys, since they do not exist on the platform.
• eIDAS compliance: the legal validity and certificate lifecycle management (issuance, renewal, revocation) are ensured by the qualified provider.
• Separation of responsibilities: SSM.ro orchestrates the signing flow and authenticates the signer; the QTSP provider is responsible for key custody and the technical act of signing.

For details on the complete signing flow (hash-based vs. full document), see System Architecture.