Appearance
Encryption Everywhere
AES-256-GCM at rest, TLS 1.3 in transit. Customer-managed keys (BYOK) and KMS integration available for Enterprise and Custom tiers.
Capabilities
- AES-256-GCM at rest
- TLS 1.3 in transit
- Customer-managed key option (BYOK)
At Rest
Every data store under AgentBrain is encrypted with AES-256-GCM:
- PostgreSQL volumes (knowledge vault, audit log, config)
- Vector store (pgvector embeddings)
- Object storage (uploaded documents)
- Backups and snapshots
In Transit
All network communication uses TLS 1.3:
- User browser to AgentBrain UI
- Agent to LLM provider
- AgentBrain to connected data sources
- Replication between availability zones
Customer-Managed Keys (BYOK)
Enterprise and Custom tiers support Bring Your Own Key:
- Keys live in your KMS (AWS KMS, GCP KMS, Azure Key Vault, on-prem HSM)
- AgentBrain never holds the raw master key
- Key rotation is driven by your KMS rotation policy
- Data is unrecoverable if you revoke the key
KMS Integration
Supported KMS backends:
| KMS | Tier Required |
|---|---|
| AWS KMS | Enterprise |
| Google Cloud KMS | Enterprise |
| Azure Key Vault | Enterprise |
| HashiCorp Vault | Enterprise |
| On-prem HSM (PKCS#11) | Custom |
Tier Availability
| Feature | Starter | Business | Enterprise | Custom |
|---|---|---|---|---|
| AES-256-GCM at rest | Yes | Yes | Yes | Yes |
| TLS 1.3 in transit | Yes | Yes | Yes | Yes |
| AB-managed keys | Yes | Yes | Yes | Yes |
| Customer-managed keys (BYOK) | No | No | Yes | Yes |
| HSM-backed root key | No | No | No | Yes |
Related
- Deployment Options for sovereign deployment
- Compliance for crypto compliance posture