Trust Centre › 3. Encryption
Encryption
In short
DIANO's web addresses accept only secure connections using TLS 1.2 or 1.3. Older, weaker versions are refused. Google encrypts all stored data, backups included, with AES-256. Google manages the keys.
On the way to and from DIANO
- DIANO's web addresses accept only secure connections using TLS 1.2 or 1.3. Older, weaker versions are refused.
- Browsers are told to always use the secure connection to diano.co.za (HSTS).
While it is stored
- Google encrypts all stored data, backups included, with AES-256. Google manages the keys.
- DIANO does not use its own encryption keys (customer-managed keys).
How Google does it: How Google encrypts stored data.
Files you download
- A company backup that a Company Admin downloads has passwords and secret keys taken out.
Keep downloaded exports and backups somewhere safe, such as an encrypted drive. Once a file leaves DIANO, its safety is in your hands.
For your IT team / auditor
Each statement on this page, how it was checked and when. Every check was read-only. The full evidence (commands and their output) is available to auditors on request.
| Statement | How it was checked | Checked |
|---|---|---|
| DIANO's web addresses accept only secure connections using TLS 1.2 or 1.3. Older, weaker versions are refused. | Google Cloud connection test (read-only check, 2026-10-20) (tls1, tls1_1: refused by the server; tls1_2 accepted; default TLSv1.3). | 2026-10-19 |
| Google encrypts all stored data, backups included, with AES-256. Google manages the keys. | Google default encryption page (published sources (see Sources), B: "encrypted at the storage layer using … AES-256"); Google Cloud storage settings (read-only check, 2026-10-20) (customer key: none (Google-managed)); Google Cloud database settings (read-only check, 2026-10-20) (cmekConfig: None). | 2026-10-19 |
| Browsers are told to always use the secure connection to diano.co.za (HSTS). | Google Cloud connection test (read-only check, 2026-10-20) (strict-transport-security: max-age=31556926). | 2026-10-19 |
| DIANO does not use its own encryption keys (customer-managed keys). | Google Cloud database settings (read-only check, 2026-10-20) (cmekConfig: None); Google Cloud storage settings (read-only check, 2026-10-20) (no default_kms_key on any bucket). | 2026-10-19 |
| A company backup that a Company Admin downloads has passwords and secret keys taken out. | DIANO's live server code and DIANO's live server code (SECRET); staging test DIANO's records 12/12 on 8 Oct 2026 ("downloads with secrets removed", DIANO's records on release/staging). | 2026-10-19 |