Encryption at rest — Unique AI Documentation
Encryption at rest
Overview
All customer data stored within the Unique Platform is encrypted at rest using industry-standard AES-256 encryption. Unique uses Customer-Managed Keys (CMK) backed by Hardware Security Modules (HSM) for every production tenant, meaning key material never leaves a certified HSM boundary and Unique has no standing access to your encryption keys.
Encryption is applied uniformly across all persistent data stores like databases and blob storages, with each service type protected by its own isolated key.
Key Principles
- Customer data is encrypted at rest at all times
- Keys are HSM-backed, customer-managed, and isolated per service
- No encryption key is shared across workload types or tenants
Encrypted Services
Encryption is applied uniformly across all persistent data stores. Each service type is protected by its own dedicated, isolated key.
| Service / Data Store | Encryption Method | Key Strength | Key Management |
|---|---|---|---|
| PostgreSQL Database | AES-256 | RSA-HSM 2048-bit CMK | Customer-Managed Key (Azure Key Vault HSM) |
| Blob / Object Storage | AES-256 | RSA-HSM 2048-bit CMK | Customer-Managed Key (Azure Key Vault HSM) |
| Encryption Key Material | FIPS 140-3 Level 3 HSM-backed | RSA 2048-bit | Azure Key Vault Premium (HSM) |
Architectural overview: Security Architecture - Single-tenant Chat.
References
- Azure Storage Service-Side Encryption
- Azure Database for PostgreSQL — Data Encryption
- About Keys in Azure Key Vault (HSM key types)
Key Management
Encryption keys are managed exclusively through Azure Key Vault Premium, which enforces hardware-backed key storage and provides a full audit trail for every key operation.
| Control | Details |
|---|---|
| Key Vault SKU | Azure Key Vault Premium. |
| HSM Standard | FIPS 140-3 Level 3: key material is generated and stored inside certified hardware security modules. |
| Access Model | Azure RBAC: each service uses a dedicated Managed Identity for access. |
| Key Isolation | One CMK per service type. No shared key material across workloads. |
| Purge Protection | Enabled on all Key Vaults. 30-day soft-delete retention prevents accidental or malicious key deletion. |
| Audit Logging | Diagnostic audit events are streamed from all Key Vaults. Every key operation is logged. |
| Key Rotation | Supported via infrastructure automation, designed for zero-downtime rotation. |
References
- Azure Key Vault — Key Management Overview
- Configuring Customer-Managed Keys with Azure Key Vault HSM for Storage
- Azure Key Vault Soft-Delete and Purge Protection
- Azure Key Vault Recovery Overview
Tenant & Key Isolation
Each tenant deployment provisions its own pair of Azure Key Vaults:
- A Standard vault for operational secrets
- A Premium (HSM-backed) vault exclusively for CMKs
Service identities are scoped to the minimum required role and can only access the keys they were explicitly assigned. There is no cross-tenant key access.
Operational Safeguards
- Purge protection is enabled on all Key Vaults, preventing immediate deletion of keys or the vault itself even by privileged administrators.
- A mandatory 30-day soft-delete retention period ensures keys can be recovered after accidental deletion.
- All Key Vault operations emit diagnostic audit events retained for compliance review.
- Key rotation is supported through infrastructure automation; the rotation process is designed to avoid service disruption.
- Access is granted exclusively via Azure RBAC. There are no shared secrets or direct key access by human operators in steady state.
Standards Alignment
| Framework | Relevant Control |
|---|---|
| ISO/IEC 27001 | A.10.1 Cryptographic controls |
| SOC 2 Type II | CC6.1 Logical and physical access controls; CC6.7 Encryption |
| NIST SP 800-57 | Key generation, storage, rotation, and destruction lifecycle |
| GDPR / nDSG | Technical and organisational measures for data protection |
| FINMA Circular 2023/1 | Operational risks and resilience for financial institutions |