Encryption Policy
Document Control
| Document ID | HL-ISMS-POL-07 |
|---|---|
| Document Title | Encryption Policy |
| Classification | Internal |
| Version | 2.0 |
| Status | Approved |
| Document Owner | Information Security Manager (ISM) |
| Approved by | Executive Management |
| Effective Date | 30.10.2026 |
| Next Review Date | Annually from effective date, or upon significant change |
| Applies to | Hamurlabs Elektronik Hizmetler Yazılım ve Ticaret A.Ş. (Istanbul, Türkiye) and Hamurlabs BV (Leuven, Belgium), together "Hamurlabs" |
1. Purpose and Scope
This policy defines the requirements for the use of cryptographic controls and the management of cryptographic keys at Hamurlabs, to protect the confidentiality, integrity and authenticity of information. It applies to all systems, services and information within the scope of the Hamurlabs ISMS, and to all personnel and service providers working with cryptographic systems, algorithms or keying material.
2. Approved Cryptographic Standards
| Use case | Approved standard | Notes |
|---|---|---|
| Data at rest (databases, storage, backups, disks) | AES-256 (or provider-managed equivalent) | Google Cloud default encryption at rest; additional application-level encryption for particularly sensitive fields where warranted |
| Data in transit (external endpoints, APIs, admin access) | TLS 1.2 or higher with strong cipher suites (AES-GCM / ChaCha20-Poly1305) | TLS 1.0/1.1 and SSL prohibited; HSTS on public web endpoints |
| Server certificates | RSA 2048-bit or higher, or ECDSA P-256 | Issued by trusted CAs; automated renewal preferred |
| SSH access | Ed25519 or RSA 2048-bit+ keys | Password-based SSH prohibited on production |
| Password storage | Adaptive one-way hashing (bcrypt, scrypt or Argon2) with per-user salt | Reversible encryption of passwords prohibited |
| Endpoint disk encryption | Platform-native full-disk encryption (FileVault, BitLocker, LUKS) | Mandatory on all company endpoints |
Deprecated algorithms (DES, 3DES, RC4, MD5, SHA-1 for signatures) must not be used. Exceptions require a documented risk assessment approved by the ISM.
3. Key Management
- Production encryption keys are generated, stored, rotated and access-controlled through the cloud provider’s key management service (Google Cloud KMS) or an equivalent approved key management system; manual key handling is avoided wherever the platform supports managed keys.
- Access to keys and to key administration functions is granted on a least-privilege basis through IAM to specifically designated identities, separated where practicable between key use (encrypt/decrypt) and key administration (create, rotate, disable, destroy).
- Keys are rotated at least every 12 months, and immediately upon suspicion of compromise.
- Keys are protected against loss, unauthorised change and destruction; managed-KMS backup and versioning satisfy this requirement for cloud keys.
- Application secrets, API keys, tokens and service-account credentials are stored only in the approved secrets manager; storage in source code, tickets, chat or documents is prohibited (see User Access Control Policy).
- When a key must be distributed (e.g. to a partner), it is transmitted over an encrypted, authenticated channel separate from any channel carrying the protected data.
- The loss, theft or potential unauthorised disclosure of any key or secret must be reported immediately to [email protected] and is handled under the Incident Management Policy.
4. Cloud Service Customer Transparency
Upon request, customers of the HaROS platform can obtain information regarding: the cryptographic controls used to protect their information; any capabilities available for customers to apply their own cryptographic solutions; and the countries/regions where cryptographic tools are used to store or transfer customer data (production: Google Cloud, Belgium — see Data Protection Policy).
5. Governing Law
The use of approved encryption must comply with the laws of the jurisdictions in which Hamurlabs operates, including any applicable import/export restrictions. Encryption must not be used to violate any law or regulation, nor to conceal violations of Hamurlabs policies.