Encryption in Transit Policy

1. Purpose & Scope

This Encryption in Transit Policy (“Policy”) defines the requirements DataChimp Labs enforces to protect the confidentiality and integrity of data as it moves between clients, DataChimp Labs services, and third parties, including the Plaid API and other financial data providers.

The Policy applies to:

  • All communication between end-user clients (browsers, mobile apps, desktop apps) and DataChimp Labs services.
  • All communication between DataChimp Labs services (service-to-service).
  • All communication between DataChimp Labs services and third-party APIs, including Plaid.
  • All administrative and management-plane traffic (SSH, cloud API calls, CI/CD, observability data, log shipping).

This Policy supplements the Information Security Policy and works in conjunction with the Encryption at Rest Policy.

2. Policy Statement

All DataChimp Labs traffic in transit is encrypted using TLS 1.2 or higher. TLS 1.3 is preferred and is the default on all endpoints that support it. Legacy protocols — SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 — are disabled and are not accepted, initiated, or negotiated.

Unencrypted transport (HTTP, FTP, Telnet, unencrypted SMTP, plaintext database protocols) is prohibited for any traffic carrying DataChimp Labs or customer data, including administrative traffic and health-check traffic where the underlying platform supports encryption.

3. Governance & Ownership

Role Responsibility
Security Lead Owns this Policy; owns the cryptographic baseline; approves exceptions.
Engineering Leadership Implements TLS termination, service-to-service TLS/mTLS, and mobile app pinning.
Cloud Platform Owner Owns AWS Certificate Manager (ACM) lifecycle, load balancer TLS configuration, and cipher policies.
Data Protection Officer Confirms that cross-border and regulated traffic meets encryption requirements imposed by regulation.
All Personnel Do not disable TLS on development or test systems that process real data; report certificate warnings.

4. Cryptographic Baseline

DataChimp Labs enforces the following baseline on external endpoints:

  • Minimum protocol. TLS 1.2.
  • Preferred protocol. TLS 1.3.
  • Disabled protocols. SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1.
  • Cipher suites. Only AEAD ciphers with forward secrecy (ECDHE key exchange + AES-GCM or ChaCha20-Poly1305). Static-RSA key exchange, CBC-mode ciphers, RC4, 3DES, export ciphers, and NULL ciphers are disabled.
  • Key exchange. Elliptic curves limited to widely reviewed curves (P-256, P-384, X25519). Legacy or non-standard curves are disabled.
  • Signature algorithms. SHA-256 or stronger. SHA-1 and MD5 signatures are not accepted.
  • HSTS. HTTP Strict Transport Security is enabled on all public web endpoints with max-age of at least one year, includeSubDomains, and submission to the HSTS preload list where appropriate.
  • HTTP redirect. Any HTTP listener on a public endpoint redirects to HTTPS with HSTS immediately; it does not accept application requests.
  • OCSP stapling. Enabled on public endpoints where the platform supports it.

The baseline is enforced by:

  • AWS security policies applied to load balancers (Application Load Balancer, Network Load Balancer, API Gateway, CloudFront) selected from the current AWS-managed TLS 1.2+ policy set.
  • Infrastructure-as-code that fixes the security policy per environment and is reviewed on every change.
  • Continuous configuration scanning that alerts on any listener that drifts from the baseline.

5. Certificate Lifecycle

Public-facing certificates are managed through AWS Certificate Manager (ACM) with the following controls:

  • Issuance. Certificates are issued by ACM (public CA) for externally addressable endpoints and by ACM Private CA for internal service-to-service certificates where mutual TLS is used.
  • Domain validation. DNS-based validation is used and validation records are maintained in infrastructure-as-code.
  • Automated renewal. ACM-managed certificates renew automatically well ahead of expiry; renewal failures generate alerts.
  • Rotation. Certificates rotate at least annually or more frequently where the platform supports it; every renewal generates a new key pair.
  • Inventory. All certificates in use (ACM, ACM Private CA, and any externally issued certificates required by specific vendors) are inventoried and monitored for expiry.
  • Revocation. Private keys suspected of compromise trigger immediate revocation and rotation; incident procedures apply.
  • Key protection. Private keys for TLS termination are managed by the AWS platform (ACM) or held in HSM-backed key stores where an externally issued certificate is required; export of private keys is prohibited.

6. Public / External Endpoints

  • All customer-facing HTTPS endpoints terminate TLS at an AWS load balancer or CloudFront distribution configured with the current TLS 1.2+ security policy and the ciphers described in Section 4.
  • Public endpoints are periodically scanned by both internal tooling and reputable external services to confirm conformance to the baseline; drift is remediated per the SLAs in the Information Security Policy.
  • Where an endpoint must interoperate with a third party that requires more permissive settings, the deviation is documented as an exception, scoped to that endpoint, time-limited, and reviewed at each Security Steering group meeting.

7. Internal Service-to-Service Traffic

Service-to-service traffic within DataChimp Labs’ cloud environments is encrypted in transit even when it traverses private VPCs and subnets:

  • TLS everywhere. Internal HTTP services listen only on TLS-terminated endpoints; plaintext east-west traffic between application services is prohibited.
  • Mutual TLS (mTLS) is used where applicable, in particular for:
    • Service meshes and internal gateways that host multiple tenants of workloads.
    • Sensitive service-to-service calls where the identity of the caller must be cryptographically verified independent of network position.
    • Administrative-plane traffic where a compromised network vantage point would otherwise permit spoofing.
  • Internal PKI. ACM Private CA (or an equivalent internal CA) issues short-lived certificates to workloads via workload identity federation.
  • No plaintext SQL or NoSQL. Database connections use TLS; drivers are configured to reject servers that do not present a valid certificate chained to the expected internal or public CA.

8. Third-Party APIs (including Plaid)

  • All traffic to third-party APIs uses HTTPS with TLS 1.2 or higher. Traffic to the Plaid API in particular uses TLS as required by Plaid and does not downgrade below the baseline described in Section 4.
  • Third-party endpoints are validated at connection time (certificate chain, hostname, expiry).
  • Where a third party publishes a certificate pinning recommendation for server-to-server integration, DataChimp Labs evaluates and, where operationally supportable, implements pinning with a documented rotation plan.
  • Outbound HTTPS traffic from production traverses egress controls that enforce allow-lists for sensitive integrations.

9. Mobile & Native Clients

  • Mobile and native clients enforce the platform’s App Transport Security or equivalent so that all network traffic uses TLS by default.
  • Certificate pinning. Mobile clients implement certificate pinning against the current active public key and the next-rotation public key. Pinning is refreshed as part of the certificate rotation runbook prior to any production key change.
  • Debug builds do not accept user-installed root certificates in production endpoints, and TLS trust customization for local development is not shipped in release builds.

10. Administrative & Management-Plane Traffic

  • Administrative access to cloud consoles uses HTTPS with the workforce MFA requirements defined in the Authentication & MFA Policy.
  • Remote shell access uses SSH with modern algorithms; legacy ciphers and MAC algorithms are disabled at the server configuration layer.
  • CI/CD, observability, log shipping, and monitoring agents transmit data over TLS; agents that do not support TLS to the intended collector are not deployed to environments processing customer data.
  • API access to cloud providers uses TLS-protected SDK calls with signed requests; plaintext control-plane API access is not offered by our cloud providers and is not attempted.

11. Exceptions

Any deviation from this Policy — for example, a legacy vendor that cannot support TLS 1.2 — requires a documented risk acceptance signed by the Security Lead, a compensating control (isolated network path, application gateway, DLP), and a defined expiration date. Exceptions are tracked in the risk register and reviewed at each Security Steering group meeting.

12. Verification & Monitoring

  • Public endpoints are scanned continuously against the baseline in Section 4; drift generates alerts.
  • Internal service inventories track TLS mode per workload; workloads that regress to plaintext are flagged in the pipeline and blocked from promotion.
  • Certificate inventories are reconciled against ACM and workload configuration; near-expiry certificates that are not on the automated renewal path generate escalating alerts starting 30 days before expiry.

13. Review Cadence

This Policy is reviewed by the Security Lead at least annually and whenever there is a material change to the cryptographic ecosystem (NIST or IETF deprecations, new vulnerabilities in TLS libraries or ciphers), the platform, or the organization. The next scheduled review date is recorded in the front-matter of this document.

14. Enforcement

Compliance with this Policy is a condition of employment or engagement with DataChimp Labs. Attempted circumvention of TLS controls (for example, disabling certificate validation, standing up plaintext listeners for real data, or exporting TLS private keys outside approved key stores) may result in disciplinary action up to and including termination, and, where appropriate, referral to law enforcement.

15. Approval & Version History

Version Date Author Change
1.0 2026-09-01 DataChimp Labs — Security Initial issue of the Encryption in Transit Policy.

Approved by: CTO, DataChimp Labs (signature on file with the Security Lead).

Contact. Security questions about this Policy should be directed to security@datachimplabs.com. Postal correspondence: DataChimp Labs, 4507 N 189th St, Elkhorn, NE 68022, USA.

Copyright © 2026 DataChimp Labs. Public Trust Center.