End-to-End Encryption — quiXzoom Security

Encryption in Transit

All communication between Zoomer devices, our servers, and orderer systems uses TLS 1.3 with perfect forward secrecy. This ensures that even if a private key is compromised in the future, past communications remain secure.

TLS 1.3 for all API and web traffic
Certificate pinning in mobile apps
HSTS enforced with 1-year max-age
Regular certificate rotation

Encryption at Rest

All stored data is encrypted using AES-256. This includes submission images, metadata, user profiles, and payment records. Encryption keys are managed through AWS KMS with strict access controls.

AES-256-GCM for all stored data
AWS KMS with automatic key rotation
Separate encryption keys per customer (tenant isolation)
Backup encryption with offline key storage

Submission Image Protection

Submission images receive special protection. Each image is encrypted individually with a unique key derived from the submission ID. Images are decrypted only at the point of delivery to authorised orderers.

Per-image encryption keys
Secure temporary URLs for image access
Automatic expiry of image access tokens
Watermarking for sensitive missions