> ## Documentation Index
> Fetch the complete documentation index at: https://help.casaconect.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption

> How data is encrypted in transit and at rest, and how file access is protected.

## In transit

All traffic between your browser, the Word add-in and Casa Conect travels over **HTTPS (TLS)**. Connections between Casa Conect's own services, and to its database and storage, are encrypted as well, and storage refuses any connection that is not.

Email is sent with TLS wherever the receiving server supports it, as is standard for mail, and outgoing mail is signed with DKIM.

## At rest

Every place your data is stored is encrypted with **AES-256**: the database and its backups, file storage, the cache, logs and application secrets.

Encryption keys are **managed keys** held by the cloud provider's key management service, with **separate keys for different kinds of data**. Access to each key is granted only to the components that need it, which limits the blast radius of any single problem, and storage refuses to accept an object that is not encrypted with a managed key.

## Signed, short-lived file access

Files are never served from public addresses. When you open or upload a file, Casa Conect first checks that you are allowed to, then issues a **short-lived signed link** for that one object. The link stops working shortly afterwards, so an address copied from your browser's history is of no use to anyone.

## Secrets that are never stored

|                                           |                                                                                                                                                          |
| :---------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Passwords**                             | There are none. Sign-in is by emailed code, through the identity provider.                                                                               |
| **Card numbers**                          | Entered with the payment provider. They never reach Casa Conect.                                                                                         |
| **Drive, OneDrive and SharePoint tokens** | Held by the identity provider's vault, and requested only when they are needed. See [Document management systems](/sources/document-management-systems). |
| **Share link URLs and access codes**      | Only one-way hashes are stored, which is why they are shown only once. See [Share links](/shared-spaces/share-links#security).                           |

## What we do not claim

<Note>
  Casa Conect does not currently offer **end-to-end encryption** or **customer-held encryption keys** (bring your own key). The service needs to read document content in order to index it for search and to let the agent work on it. Data is encrypted at rest and in transit, and it is processed in clear form inside the platform's private network. If customer-held keys are a requirement for you, [let us know](mailto:support@casaconect.ai).
</Note>

<Note>
  This page describes our security practices at the level of a help page. We share detailed security documentation, architecture reviews and completed questionnaires with customers on request. Write to [support@casaconect.ai](mailto:support@casaconect.ai).
</Note>