Your data now lives on an encrypted disk

In August we encrypted the most identifying things we hold, issue titles first, inside the database. That protected the fields. It left everything around them, the rest of the database, the cache, the files on the server, readable to anyone holding a copy of the disk.

That gap is now closed.

What changed

Your data is on an encrypted disk. The database, the cache, the local backups and the service's own secrets moved onto a separate encrypted volume.

The disk can't unlock itself. Its key isn't kept on the server. When the machine starts, it has to reach a key server that lives somewhere else, and only then does the disk open. A copied disk, a snapshot taken by the hosting provider, or a drive pulled from the rack is ciphertext on its own. We tested that the way it matters: with the key server out of reach, the disk stayed locked.

The old copies are gone. Moving data onto an encrypted disk does nothing for the copy it came from. The old database and cache files on the plain disk were deleted, and the space they took up on the disk was trimmed.

The encryption key was replaced. The key that encrypts titles and tokens inside the database was rotated during the move, and every encrypted value was re-encrypted under the new key and checked.

Two layers

Inside the encrypted disk, the application still encrypts the fields that say the most about your work: issue and merge request titles, milestone titles, branch names, the snapshots of linked issues, webhook deliveries waiting to be processed, and every access token. So reading those needs the disk's key and the application's key, and they are not kept in the same place. Off-site backups are encrypted before they leave the server, as they have been since August.

What this is not

This is encryption at rest. GitGumbo decrypts your data to draw your board, which is the point of a board, so it is not end-to-end encryption and we don't call it that. What it guarantees is narrower and still worth having: a copy of our storage, taken without the running service, tells nobody what your team is working on.