HealthyRides

Encryption

How HealthyRides encrypts patient information in transit and at rest.

In transit

The app is served over HTTPS from a Google Cloud load balancer holding a Google-managed certificate, and a plain HTTP request is redirected to HTTPS (infrastructure/modules/https-lb/main.tf).

The load balancers for the app, this site and its media host each carry an SSL policy that accepts TLS 1.2 or later, with Google Cloud's MODERN cipher profile, and refuse TLS 1.0 and 1.1 (infrastructure/modules/https-lb/main.tf; infrastructure/modules/media-cdn/main.tf). This meets the requirement of TLS 1.2 or later (docs/prd/healthyrides-mvp-prd.md).

The database accepts encrypted connections only, and it has no public IP address: it is reached on a private network inside the project (infrastructure/modules/cloud-sql/main.tf).

The background worker that sends notifications and archives the audit log accepts traffic from inside Google Cloud only, and each of its routes checks the caller's signed identity token (infrastructure/environments/prod/main.tf; docs/decisions/0034-audit-rows-are-archived-daily-to-a-retention-locked-bucket.md).

Email leaves through Amazon SES over SMTP with TLS required (docs/decisions/0006-aws-ses-transactional-email.md). Text messages, once switched on, go to Twilio's API over HTTPS (platform/packages/integrations/src/sms.ts).

A signed-in session is a cookie whose contents are encrypted and authenticated, not merely signed, so the browser can neither read nor alter it (platform/apps/web/lib/server/session.ts).

The cookie is HttpOnly, so no script in the page can read it, SameSite=Lax, and Secure on HTTPS (platform/apps/web/lib/server/session.ts).

At rest

The database, its backups and the storage buckets are Google Cloud services, encrypted at rest by Google Cloud's default encryption, which uses AES-256. HealthyRides' configuration sets no customer-managed encryption key on any of them (infrastructure/modules/cloud-sql/main.tf; platform/packages/domain/src/agreements/texts/baa-v2.ts; docs/prd/healthyrides-mvp-prd.md).

Production keeps automated database backups, the last 30, with point-in-time recovery, and the database cannot be deleted while deletion protection is on (infrastructure/environments/prod/terraform.tfvars).

Keys and secrets

No downloadable service-account key exists, ever: services and pipelines use short-lived credentials only (README.md).

The images that run in production are signed with a key held in Google Cloud KMS, and production runs the same image, by digest, that ran in development (docs/decisions/0036-images-are-signed-with-a-kms-key-and-nothing-goes-to-rekor.md; README.md).