Encryption
This page states what is encrypted, with which algorithm, so questionnaires can be answered without inferring controls from marketing language.
Short definition (citation-ready)
Public Qefro surfaces terminate TLS. Secrets (Business Tool credentials, SDK signing secrets, channel tokens, Access Service auth) are stored with AES-256-GCM. Organization user passwords are bcrypt hashes. Session access tokens are HS256 JWTs; refresh tokens are HttpOnly cookies.
In transit
| Surface | Transport |
|---|---|
https://api.qefro.com | TLS (HTTPS only for customers) |
https://app.qefro.com | TLS |
Widget CDN https://cdn.qefro.com/widget.js | TLS |
| Tool / SDK egress from Qefro | HTTPS required — HTTP tool URLs are rejected (Network & egress) |
| WhatsApp Cloud API / Razorpay | Provider HTTPS + signature verification |
Private / VPC-style deployments terminate TLS according to the Enterprise packaging — confirm with Sales.
At rest — secrets (AES-256-GCM)
Application-level encryption for credentials uses AES-256-GCM:
- Key from
ENCRYPTION_KEY(minimum 32 bytes; first 32 bytes used as the key) - Random 12-byte nonce per encryption, prepended to ciphertext
- Combined nonce + ciphertext stored as Base64
This path encrypts (among others):
- Business Tool secrets
- External SDK Connection signing secrets
- WhatsApp / channel tokens
- Customer Access Service API auth
- Enterprise identity client secrets and IdP refresh tokens (when that subsystem is enabled)
Plaintext is decrypted only for egress (tool call, /qefro sign, or provider API). Identity and tool loggers are designed not to echo these values.
Passwords
Admin Console, Internal Portal, and partner passwords are stored as bcrypt hashes (cost factor 10). Qefro does not store customer passwords; those remain in your Customer Access Service.
Tokens
| Token | Algorithm / storage |
|---|---|
| User / widget access JWT | HS256 (jsonwebtoken default header), secret from JWT_SECRET (must be ≥ 32 bytes; placeholders rejected at boot) |
| Access JWT lifetime | Default 24 hours (JWT_EXPIRY_HOURS) |
| Refresh token | Opaque session token in HttpOnly cookie qefro_refresh (30-day max-age, SameSite=Lax, Secure in production) |
/qefro invoke | HMAC-SHA256 hex digest, v1= prefix — Authentication |
| Marketplace package | Ed25519 over id|version|checksum — Application security |
What encryption is not
- Chat PII masking is regex redaction, not encryption — Data handling
- Widget tokens are not secret
- Document bytes served to authorized viewers use a restrictive Content-Security-Policy (
default-src 'none'; sandbox; …) to prevent script execution; that is containment, not encryption