M9-06 Security Hardening — Key Rotation¶

Milestone: M9 — Hardening and Compliance SOW Reference: NFR3, Appendix 2 milestone description Requirement Clarity: ✅ Clear Dev Status: 🟡 Partially prototyped — per-tenant encryption keys exist (M2-12/velocity-tenant.service.ts), but rotation is not automated

Overview¶

Automate rotation of the encryption keys used for tenant credentials and column-level encryption (M9-00 audit), rather than relying on one-time-generated keys.

Backend Tasks¶

Define a key-rotation schedule/policy
Implement rotation for tenant keys (admin/services/velocity-tenant.service.ts) and the AES-256 column encryption keys (shared/transformers/encrypted-column.transformer.ts)
Ensure rotation doesn't break decryption of previously-encrypted data (key versioning)

Frontend Tasks¶

N/A

Dependencies¶

M9-00 security audit — details current encryption implementation this builds on.

Acceptance Criteria¶

Feeds into "Security testing completed" (Appendix 3, Overall Solution Acceptance) — no standalone criterion currently listed, worth adding one.

Existing Reference Material¶

M9-00-security-encryption-audit.md

Blockers & Risks¶

Risk: key versioning must be handled carefully to avoid breaking decryption of existing records — plan a migration path, not a hard cutover.