modules
Encryption & Key Management
End-to-end encryption with AES-256-GCM at rest, TLS 1.3 in transit, field-level PII encryption, and support for customer-managed encryption keys (CMEK).
End-to-end encryption with AES-256-GCM at rest, TLS 1.3 in transit, field-level PII encryption, and support for customer-managed encryption keys (CMEK).
encryption-at-every-layer
Encryption at Every Layer Encryption & Key Management provides defense-in-depth across all DXP data. AES-256-GCM encryption at rest protects stored data. TLS 1.3 encrypts all data in transit. Field-level encryption applies additional encryption to PII fields — so even database access doesn't expose sensitive data. Customer-managed encryption keys (CMEK) give enterprise customers full control over their encryption keys via AWS KMS, Google Cloud KMS, or Azure Key Vault. DXP never stores or has access to plaintext customer keys.
data Viz
Encryption Specifications
- At Rest
- AES-256-GCM with automatic key rotation
- In Transit
- TLS 1.3 with perfect forward secrecy
- Field Level
- Per-field encryption for PII with separate keys
- CMEK
- AWS KMS, Google Cloud KMS, Azure Key Vault
- FIPS
- FIPS 140-2 validated cryptographic modules
features
cmek: true
tls 13: true
aes 256: true
field level: true