Encryption
Status: Placeholder. Content currently lives inline in approvals-and-annotations and enforcement. A dedicated page will extract the AES-256-GCM, envelope encryption, and key rotation sections.
Quick Reference
TnsAI uses AES-256-GCM for at-rest encryption of sensitive fields. Keys are managed via an envelope pattern (data key + master key).
See Enforcement for the current encryption section.
Planned Content
- AES-256-GCM setup.
- Envelope encryption (data encryption key + master key).
- Key rotation.
- Integration with external KMS.
Prompt Injection Defense
Previous Page
Redaction
The Quality module ships a pluggable redaction layer that scrubs PII and secrets out of every framework boundary that could leak — log lines, trace attributes, memory writes, captured LLM prompts, agent events. Redaction is always-on when the decorator is wired in; opt-out is per-tenant per-sink, never the default.