Encryption

This page explains how MetaDefender Cloud uses encryption to protect your files and data, and which extra encryption options you can use. Values in [brackets] are to be confirmed before publishing. 

Data 

Protection 

Managed by 

Traffic to the web portal and API 

HTTPS, TLS [1.2] or higher 

OPSWAT 

Uploaded files 

Encrypted at rest, [AES-256] 

OPSWAT, using AWS Key Management Service (KMS) 

Scan results, scan history and account data 

Encrypted at rest, [AES-256] 

OPSWAT, using AWS KMS 

Backups 

Encrypted at rest, [AES-256] 

OPSWAT, using AWS KMS 

Passwords 

[Not stored by MetaDefender Cloud; handled by OPSWAT's identity service] 

OPSWAT 

Files in flight (optional) 

RSA encryption with your own key 

You 

API connection (optional, enterprise licence) 

Mutual TLS with your own certificate 

You and OPSWAT 

1. Data in transit 

All communication with MetaDefender Cloud, through the web portal and the REST API, is encrypted with HTTPS. Connections using TLS versions older than [1.2] are refused. Traffic between MetaDefender Cloud services inside AWS is also encrypted [with TLS]. 

2. Data at rest 

All user files are automatically encrypted when stored, as are scan results, scan history, account data and backups. Storage is encrypted with [AES-256] using keys held in AWS KMS. Your data stays encrypted in the region it is processed in; see Locations. 

With private processing, your file is deleted after analysis. See the Responsibility Matrix for how long data is kept. 

3. Key management 

  • OPSWAT manages the encryption keys for data at rest in AWS KMS. Keys never leave KMS in plain form. 

  • Keys are rotated [automatically every year]. 

  • Access to keys is limited to authorised OPSWAT operations staff and services, and every use of a key is logged. 

  • Customer-managed keys (bring your own key) are [not currently supported]. 

4. Credentials 

  • API keys are [stored encrypted / stored as hashes] and are only shown to you on your account page. 

  • Passwords are [not stored by MetaDefender Cloud: sign-in is handled by OPSWAT's identity service, or by your own identity provider if you use single sign-on]. 

5. Extra encryption options for you 

  • RSA file encryption: encrypt your sanitized files with your own RSA key while they are being stored by MetaDefender Cloud.

  • Mutual TLS: OPSWAT sets up a dedicated endpoint that accepts only requests carrying your certificate and private key. See the Responsibility Matrix. 

6. Your responsibilities 

  • Use only HTTPS endpoints and keep TLS validation turned on in your integrations. 

  • Keep your API keys, RSA private keys and mutual TLS private keys secret, and rotate them on your own schedule. 

  • If you use your own identity provider, protect its sign-in with multi-factor authentication. 


On This Page
Encryption