amaise consistently uses AES-256 encryption for all data at rest. This includes all storage layers: customer documents in S3, the relational database (Aurora PostgreSQL), full-text indexes (OpenSearch), DynamoDB tables, and all EBS volumes.

For customer data in S3, encryption is implemented using individual, tenant-specific KMS keys (Customer Managed Keys). Infrastructure data (e.g., global assets) is encrypted with AWS-managed keys.

For data transmission, amaise exclusively uses TLS 1.2 as a minimum, with support for TLS 1.3. Older protocols are disabled. All public endpoints automatically redirect HTTP to HTTPS.