Encryption at rest
Last updated: Nov 4, 2026
All the applications and services of Fluid Attacks have industry-standard encryption at rest.
- Fluid Attacks encrypts all the sensitive data from its clients (repository access keys, VPN credentials, and other data) with the symmetric algorithm of its key management system (KMS). This algorithm uses Advanced Encryption Standard (AES) in Galois Counter Mode (GCM) with 256-bit private keys. AES256 is the US government standard encryption algorithm that protects top-secret information. Also, HMAC with SHA-256 hashes protects client data.
- DNSSEC protects all the domain names of Fluid Attacks. It makes sure that the DNS records that clients receive are identical to the DNS records that Fluid Attacks publishes.
- Fluid Attacks stores all the code repositories of its clients in private, AES256-ciphered redundant data centers.
- Fluid Attacks stores its exploits encrypted with AES256 keys.
- Fluid Attacks stores all the data of the Fluid Attacks platform in an AES256-encrypted database.
- Fluid Attacks decrypts most of its encrypted-at-rest secrets only in memory. Thus, these secrets are never on a hard drive after decryption. This highly decreases the possibility of a data leak from unprotected files with decrypted secrets on hard drives.
- All the components of Fluid Attacks use its KMS for development and production secrets.
- All the Mac laptops of Fluid Attacks have their hard drives encrypted with FileVault.
Requirements
These Fluid Attacks requirements apply to the controls on this page:
- 127. Store hashed passwords
- 150. Set minimum size for hash functions
- 176. Restrict system objects
- 185. Encrypt sensitive information
- 224. Use secure cryptographic mechanisms
Other confidentiality measures
Direct hiring
Fluid Attacks hires all talent directly via indefinite-term contracts, avoiding contractors or third parties due to the nature of its business.
Encryption in transit
Fluid Attacks ensures data security with TLSv1.3, HSTS, and short-lived certificates that renew automatically, maintaining an SSL Labs A+ rating across all connections.