Work
Encryption Service Adopted Across Teams
A centralized encryption API simplified down to two methods, with fully automatic key rotation.
Brief
Several teams were each building their own encryption, inconsistently. Some weren’t rotating keys; none of it was audited centrally.
Approach
- Centralized Service: Built a multi-tenant encryption service in Java that exposed a clean gRPC interface for other teams.
- Secure Infrastructure: Backed the service with a hardware security module for key generation and storage, defined via Terraform.
- Automatic Key Rotation: Designed the system to seamlessly use new keys for new data while decrypting old data via key versioning stored inside the encrypted payload—requiring zero migrations or config changes.
Result
Adopted across several teams within weeks. Security review time for new services dropped significantly.