Security — Tortoise Hosted Service

1. TLS in transit

Hosted API traffic (api.premiselabs.co) is served over HTTPS. TLS 1.2 and TLS 1.3 are the supported protocol versions, terminated at the Fly.io edge.

2. Encryption at rest

OAuth tokens (e.g., GitHub) are encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256). The key comes from the TORTOISE_ENCRYPTION_KEY environment variable, is never stored in the database, and the service fails closed if the key is missing. Encrypted token columns are revoked from anonymous and authenticated roles.

Encryption at rest applies to OAuth tokens specifically; it does not extend to all data stored by the service.

3. API key hashing

API keys are stored only as one-way hashes — PBKDF2-HMAC-SHA256 with a per-key 32-byte random salt and 100,000 iterations, plus a server-side pepper. A separate peppered SHA-256 digest enables constant-time lookup; the plaintext key exists only at creation time.

4. Audit logging

Control-plane operations — account registration, API key creation and issuance, deletion requests, and authentication failures — are logged with actor, operation, resource, IP, and timestamp. Events are written to Postgres first, with a local JSONL fallback and automatic replay on recovery.

Audit events cover control-plane operations — not every API request is logged.

5. SOC 2 roadmap

Tortoise is not SOC 2 certified. Compliance is a roadmap item: we are building toward a readiness posture across access control, change management, vendor management, training, and incident response — scoping → readiness → audit.

6. Credentials

Tortoise runtime (hosted API): the runtime stores API keys and OAuth tokens — it has no password system.

Dashboard (app.premiselabs.co): account passwords for the dashboard are stored using salted hashing by Supabase Auth.