Skip to content

Last reviewed: 2026-07-29 Accepted decision: - ../../decisions/accepted/0030-sensitive-company-data-key-recovery-and-backup-protection.md

Contract: Company data encryption

Purpose

This contract defines the minimum data-at-rest protection expectations for BooksPlus company data.

Contract

BooksPlus company data must be protected against casual file copying, backup leakage, and unintended plaintext exposure.

Rules

  • Company data storage must be documented.
  • Sensitive company data must not be stored casually in plaintext files.
  • Encryption keys must not be hard-coded in the application.
  • Local keys must be protected by operating system secure storage where practical.
  • Recovery behavior must be documented.
  • Backup encryption must be supported.
  • Sensitive fields and managed sensitive artifacts use versioned AES-256-GCM envelope encryption with fresh data keys and nonces.
  • Authenticated context binds every protected payload to company, owner, purpose, and envelope version.
  • Company keys are wrapped by a customer-held recovery secret that is not stored in company data or backups.
  • Plaintext keys and protected values must not enter logs, audit events, telemetry, support bundles, ordinary exports, or routine snapshots.
  • There is no plaintext-file fallback for recovery secrets or company keys.
  • Key rotation rewraps data keys without changing business identity and must be atomic and audited.

Protected actions:

  • company_data_protection.initialize
  • company_data_protection.unlock
  • payee_tax_profile.maintain
  • payee_tax_profile.view_tin
  • information_return_payer_profile.maintain
  • information_return_payer_profile.view_tin
  • information_return_draft.prepare
  • information_return_filing.approve
  • information_return_filing.export_handoff
  • information_return_filing.submit
  • information_return_filing.record_result

Initialization, unlock, full-value viewing, filing approval, and filing handoff export require a reason and step-up confirmation. TIN and W-9 maintenance uses the distinct profile-maintenance action. Every result is audited without recovery material, taxpayer values, masked values, filing payloads, acknowledgments, ciphertext, digests, or key material.

Acceptance criteria

  • A copied company database or backup is not casually usable without authorization or key material.
  • Key handling is documented.
  • Backup files are encrypted or otherwise protected.
  • Exporting decrypted company data requires authorization and audit logging.
  • Cross-company envelopes and keys are rejected.
  • Integrity failures disclose no protected value or key detail.
  • Losing all recovery-secret copies is explicitly documented as unrecoverable.