Encryption

How Chief encrypts your sensitive data — at rest, in transit, and at the application layer.

At Rest

All Chief data lives in Convex, which encrypts the underlying storage with AES-256 at rest.

Beyond the platform default, Chief adds a second encryption layer for sensitive fields (credentials, API keys) inside the database. So even if a database read were leaked, those fields would still be ciphertext.

In Transit

All connections use TLS 1.2+:

• Slack ↔ Chief — Socket Mode WSS (wss://)
• Chief ↔ Convex — TLS-terminated by Convex’s serverless edge
• Chief ↔ LLM providers — HTTPS to provider endpoints
• Browser ↔ Dashboard — HTTPS, HSTS preload

There’s no plaintext wire path.

Application-Layer (Sensitive Fields)

For high-sensitivity fields, Chief adds AES-256-GCM encryption inside the application before writing to the database. This applies to:

• LLM provider API keys (Anthropic, OpenAI, Gemini)
• Integration credentials (Stripe keys, GitHub tokens, etc.)
• Custom integration secrets

The encryption key (CREDENTIAL_ENCRYPTION_KEY) lives on the agent host, not in the database. A database leak alone cannot decrypt these fields. The agent must be running, with the key loaded, to decrypt.

Key Rotation

Per-credential rotation: any user can rotate a credential by deleting and re-adding it. This issues a new ciphertext encrypted with the current master key.

Master key rotation: managed by Chief operations on a regular schedule. When the master key rotates, all existing ciphertexts are rewrapped to the new key in a single batch transaction. There’s no observable downtime.

Decryption Boundaries

Decryption happens only at the moment of use:

• An LLM key is decrypted in-memory when Chief makes a call to that provider, then immediately discarded.
• An integration credential is decrypted when Chief makes a request to that integration, then discarded.

Plaintext credentials are never persisted to disk, never logged, and never written to memory beyond the immediate scope of the API call.

What’s Not Application-Encrypted

• Slack thread content (encrypted at rest by Convex but not application-layer; decryption happens server-side for legitimate queries)
• Generated files (same — at-rest encryption only)
• Usage records and metadata
• Audit logs

Application-layer encryption is reserved for credentials and outbound auth tokens. Adding it to thread content would prevent Chief from working at all.

What This Means for Compliance

For GDPR / CCPA / SOC 2 reviews, the relevant statements are:

• All data is encrypted at rest (AES-256, Convex platform).
• All data is encrypted in transit (TLS 1.2+).
• Authentication credentials are additionally application-layer encrypted (AES-256-GCM).
• Encryption keys are managed separately from data; rotation is supported.
• A successful database compromise does not yield plaintext credentials.

Email security@hirechief.ai for the detailed encryption architecture document under NDA.