Key rotation policy

Rotated by the platform

• Out-of-band management credentials, rotated automatically on a 30 day cycle.
• Platform internal service credentials, rotated on a 30 day cycle.
• Facility access credentials, rotated on personnel change and reviewed quarterly.
• Memory encryption keys, generated per enclave launch and never persisted.

Memory encryption keys are not recoverable by anyone, including us. That is the point of the design, and it means there is no key escrow path to ask about.

Rotated by you

• Client Portal API secrets. No forced expiry, but 90 days or less is expected and is checked at assessment.
• SSH keys for host operators. Rotate on personnel change, without exception.
• Any application-level keys or certificates, on your own schedule.
• Interconnect pre-shared keys, coordinated with us on a 180 day cycle.

Rotating without downtime

For API secrets and interconnect keys, both old and new are valid during an overlap window. Create the replacement, deploy it, confirm traffic has moved, then revoke the old value. Revoking first is the usual cause of a self-inflicted outage.

For SSH keys, add the new key to the host before removing the old one, and confirm you can authenticate with the new key from a separate session before closing the one you are working in.