Encryption standards.

No jargon without explanation. Here is exactly what we use, where we use it, and what it means in plain language.

AES-256-GCM

All data at rest

Your credentials are encrypted with the same standard used by the US government for classified data. GCM mode provides authenticated encryption — tampered ciphertext is rejected automatically.

TLS 1.3

All data in transit

Every API call between your infrastructure and Nayker uses TLS 1.3 — the latest transport security protocol. Perfect forward secrecy is mandatory. Older TLS versions are rejected.

mTLS

Agent identity verification

Every agent presents a client certificate on every request. Both sides verify each other. An agent without a valid certificate cannot communicate with Nayker — period.

BYOK

Enterprise tier

Bring Your Own Key. Your AWS KMS key, your AWS account, your control. Nayker's IAM role can encrypt and decrypt — but cannot export, disable, or delete the key. You can revoke access instantly.

Encryption keys are rotated automatically every 90 days. Key rotation does not require downtime or re-encryption of existing data.