❓ Encryption: How does FTAPI protect my data during transmission and storage?

Encryption in transit and at rest

Every data transfer between your client, for example the Outlook Add-In or your browser, and the FTAPI Cloud is encrypted with TLS 1.3. In addition, all data is segmented and encrypted with AES-256 bit before being stored in the FTAPI Cloud. Your data is therefore always encrypted, both in transit and at rest.

End-to-end encryption with SecuPass

With security levels 3 and 4, a true end-to-end encryption based on the zero-knowledge principle is available.

The private key required to encrypt and decrypt the data is protected on the client by a password you choose yourself, the SecuPass. The key material therefore never leaves the client unprotected, and FTAPI does not hold a master key for it.

As a result, even an attacker who gained access to the FTAPI Cloud would have no access to end-to-end encrypted files. FTAPI administrators cannot access data at security levels 3 and 4 either.

The password used to encrypt and decrypt data on the client is kept in memory only for the duration of a session, meaning as long as the browser tab or Outlook stays open. It is deleted afterwards and cannot be directly accessed by an attacker on the client.

Difference to security levels 1 and 2

At security levels 1 and 2, the key material required for decryption is available on the server side, so that FTAPI can decrypt the data for you, for example for the preview function or the server-side virus scan. These levels still provide full encryption in transit and at rest, but not end-to-end encryption based on the zero-knowledge principle.

Which security level is right for your use case depends on the desired balance between convenience and protection level.

Note: Keep your SecuPass safe. Without the SecuPass, decrypting your end-to-end encrypted data is not possible, not even for FTAPI.

Similar articles

📋 The FTAPI security levels
📋 The SecuPass technology