Encryption & Key Management
Every sensitive value MeetLoyd stores is encrypted at rest with AES-256-GCM — authenticated encryption, so tampering is detected, not just confidentiality preserved. This page covers how your secrets and credentials are protected. For your business data (agent memories, conversations, context graph) and customer-managed keys, see Data Sovereignty.
What's encrypted
The platform vault holds the credentials that make your agents work, and each is encrypted before it ever touches disk:
- Your LLM provider keys (BYOK — Anthropic, OpenAI, Google, and the rest)
- OAuth tokens for every connected app (Google Workspace, Microsoft 365, HubSpot, Slack, …)
- Two-factor and SSO secrets
- Agent signing keys (the private keys behind each agent's verifiable identity)
- Webhook and integration secrets
Alongside these, your business data can be encrypted with a key you control — see CMEK & Bring-Your-Own-KMS.
How it works
MeetLoyd uses envelope encryption — a key hierarchy rather than one key for everything:
- A root key protects the keys below it; it never encrypts data directly.
- Per-tenant and per-purpose keys encrypt the actual values.
This structure is what makes the guarantees below possible: a stolen database snapshot is opaque without the keys, and one tenant's keys are isolated from another's.
| Property | What it means for you |
|---|---|
| Confidentiality | A database snapshot is unreadable without the keys — the stored values are ciphertext, not text. |
| Authenticity | The AES-256-GCM authentication tag detects any tampering; modified ciphertext fails to decrypt rather than returning altered data. |
| Per-value randomness | Every value uses a fresh random IV, so identical secrets encrypt to different ciphertext. |
| Isolation | Business-data keys are per-tenant, so the blast radius of any single key is one tenant. |
Key rotation
Encryption keys are versioned — every encrypted value records which key protected it. That means a key can be replaced with a new one without downtime and without a mass re-encryption: new writes use the new key, existing values keep decrypting under theirs, and older values migrate to the new key over time. Rotation is designed to be a routine, non-disruptive operation rather than a maintenance event.
For customer-managed keys, you drive rotation yourself from Settings → Data Protection — see the rotation steps in Data Sovereignty.
In transit
All traffic — API, dashboard, agent tool calls, and cross-organization messages — uses TLS 1.3. Encryption at rest and in transit are independent layers; you get both on every plan.
Proving it to an auditor
- The audit log records every key operation (generate, rotate, revoke, KMS configuration) with a timestamp and the actor.
- Your Data Protection page shows the active tier and key fingerprint.
- We can provide a signed attestation of your tenant's encryption posture on request.
Not sure which of your connectors use customer-managed keys, or want to check your current encryption tier? Ask Loyd — it can point you straight to the right setting in your workspace.
Next: review Data Sovereignty to choose where your business data lives and who holds the key, or Governance Packs to layer automated compliance controls on top.