Overview

FamilyNest processes highly sensitive personal information, including prenatal records, pediatric health notes, behavioral tracking, and private family communications. Our encryption architecture is designed to meet enterprise-grade security standards while remaining transparent and accessible to parents.

This document details our cryptographic controls, data protection methodologies, and third-party validation processes. All specifications undergo quarterly review and are aligned with current NIST guidelines and pediatric data protection requirements.

Encryption Protocols

We enforce strict cryptographic baselines across all infrastructure layers. Deprecated or vulnerable algorithms are systematically blocked and replaced.

🔒 TLS 1.3 (Transport)

Mandatory for all external traffic. HSTS enforced with max-age=31536000; includeSubDomains. Only AEAD cipher suites permitted (TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256).

💾 AES-256-GCM (Storage)

Industry standard for data at rest. Applied at the filesystem, database, and object storage layers. Provides authenticated encryption to detect tampering.

🔑 RSA-4096 / ECDSA P-384

Asymmetric cryptography for certificate validation, secure key exchange, and microservice authentication. Prevents man-in-the-middle attacks.

🛡️ Argon2id (Passwords)

Memory-hard password hashing with configurable iterations, parallelism, and memory cost. Zero reversible storage. Salted per user account.

Data States & Protection Scope

Data State Control Mechanism Applicable Systems
In Transit TLS 1.3 + mTLS for internal mesh API gateways, web clients, CDN, service-to-service
At Rest AES-256-GCM (transparent & app-level) PostgreSQL, S3 object storage, EBS, cold backups
In Use (Client) WebAssembly client-side encryption Medical journals, financial records, private chats
Deleted/Archived Cryptographic shredding + secure overwrite GDPR/CCPA erasure requests, retention expiration
🔐 Zero-Knowledge Fields: Sensitive family notes and pediatric health inputs are encrypted client-side before transmission. FamilyNest infrastructure never holds the decryption keys for these fields.

Key Management & Lifecycle

Encryption keys are managed through a defense-in-depth hierarchy to prevent single points of failure and unauthorized access:

  • HSM-Backed Root Keys: Stored in FIPS 140-2 Level 3 certified Hardware Security Modules (AWS CloudHSM). Physical and logical isolation enforced.
  • Envelope Encryption: Data encryption keys (DEKs) are wrapped by key encryption keys (KEKs). DEKs are rotated automatically every 90 days.
  • Just-In-Time Access: Cryptographic operations require MFA and temporary IAM elevation. No long-lived service account keys.
  • Revocation & Rotation: Automated drift detection triggers immediate re-encryption workflows if compromise indicators are detected.

Compliance & Independent Validation

Our encryption posture supports regulatory frameworks critical to family, child, and health data protection:

🇪🇺 GDPR (Art. 32) Compliant

Mandates encryption for confidentiality and integrity. We implement pseudonymization, data minimization, and breach notification within 72h.

👶 COPPA 1998 Compliant

Enhanced parental verification, strict retention limits, and cryptographic isolation of under-13 data segments.

📊 SOC 2 Type II Audited

Annual third-party assessment of cryptographic controls, access management, and operational resilience.

🌐 ISO 27001:2022 Certified

Comprehensive ISMS covering encryption governance, risk treatment, and continuous improvement cycles.

Monitoring & Incident Response

Encryption effectiveness is continuously validated through automated and manual controls:

  • Real-time TLS handshake analysis and cipher suite compliance enforcement
  • Automated scanning for weak endpoints, expiring certificates, and legacy protocol usage
  • Quarterly penetration testing by accredited CREST/OSSTMM firms
  • Coordinated vulnerability disclosure (CVD) program with responsible researcher rewards

In the event of a cryptographic incident (e.g., suspected KEK compromise), our protocol mandates immediate key rotation, dataset re-encryption, forensic logging, and transparent stakeholder notification per regulatory timelines.

Security Contact & Verification

For technical inquiries, encryption attestation requests, or vulnerability reports:

📧 security@familynest.com
🔐 Keybase / PGP Public Key
📄 Download Cryptography Compliance Attestation (PDF)

All submissions are handled under responsible disclosure guidelines. We prioritize researcher safety and timely remediation.