10. Cryptography

10.1 Glesys applies cryptographic controls for the protection of sensitive information and communications, including:

a) protection of data in transit using TLS (minimum TLS 1.2+) together with strong encryption (e.g. AES-256 or equivalent) for the protection of sensitive data at rest, where applicable;

b) key management procedures ensuring that cryptographic keys are managed securely, rotated at least annually or after suspected compromise, and protected from plaintext storage in code or configurations; and

c) use of approved hashing algorithms (e.g. SHA-256+) and prohibition of weak or deprecated algorithms (e.g. MD5/SHA-1).