Enterprise-Grade Encryption for Terraform State
FreeState encrypts all workspace state data at rest using AES-256-GCM with per-workspace encryption keys. Optional BYOK (Bring Your Own Key) lets you maintain full control over your master encryption keys.
Envelope Encryption
Industry-standard two-tier key hierarchy. Each workspace gets a unique Data Encryption Key (DEK), wrapped by a master Key Encryption Key (KEK).
BYOK Support
Use your own AWS KMS, Azure Key Vault, or GCP Cloud KMS key as the master encryption key. Full customer control.
Fast Rotation
Rotate keys in seconds with zero downtime. All workspace DEKs are atomically re-encrypted in a single transaction.
Full Audit Trail
Every key operation is logged with actor, timestamp, and context. Immutable audit logs for compliance and forensics.
Compliance Ready
FIPS 140-2 validated HSMs, SOC 2 Type II certified, HIPAA-ready, and GDPR compliant.
Zero Setup
Envelope encryption enabled by default for Team and Enterprise plans. Basic AES-256 encryption at rest included for all paid plans. New workspaces automatically encrypted with <10ms overhead.
How Envelope Encryption Works
FreeState uses a two-tier key hierarchy called envelope encryption. This is the same model used by AWS, Google Cloud, and Azure for their own encryption services.
Key Components
- Data Encryption Key (DEK): A unique AES-256-GCM key generated for each workspace. The DEK encrypts the actual Terraform state data. DEKs are stored encrypted in the database — never in plaintext.
- Key Encryption Key (KEK): The master key stored in your cloud KMS (AWS KMS, Azure Key Vault, or GCP Cloud KMS). The KEK wraps (encrypts) each DEK. With BYOK, you control this key.
- FreeState-Managed KEK: By default, FreeState manages the KEK in its own AWS KMS account. You can switch to BYOK at any time with zero downtime.
Security Properties
- KEK never leaves the KMS service — FreeState only calls KMS to encrypt/decrypt DEKs
- DEK plaintext is cached in memory for ~5 minutes to reduce KMS API calls, then discarded
- Each state write uses AES-256-GCM with a random nonce — no key reuse
- Encryption context includes
organization_idto prevent cross-org key misuse
Encryption Tiers
| Feature | Developer | Team | Enterprise |
|---|---|---|---|
| Encryption at rest (AES-256-GCM) | ✓ | ✓ | ✓ |
| Envelope encryption (DEK/KEK) | — | ✓ | ✓ |
| Key rotation | — | ✓ | ✓ |
| Encryption audit logs | — | ✓ | ✓ |
| BYOK (Bring Your Own Key) | — | — | ✓ |
| FIPS 140-2 compliance | — | — | ✓ |
Compliance & Certifications
- FIPS 140-2: All KMS providers use FIPS 140-2 validated HSMs. AES-256-GCM is a FIPS-approved algorithm.
- SOC 2 Type II: Encryption controls are covered in our annual SOC 2 audit. Reports available under NDA — contact compliance@freestate.cloud.
- HIPAA: Business Associate Agreements (BAA) available for Enterprise customers. Encryption at rest satisfies HIPAA Safe Harbor requirements.
- GDPR: Encryption key deletion triggers cryptographic erasure — state data becomes unreadable, satisfying the right to erasure.