Encryption in transit
Domino web application
Domino serves its web application and API over HTTPS and terminates TLS at the ingress load balancer using a certificate you provide during installation: on AWS, you apply an SSL certificate ARN to the load balancer; on Azure and GCP, you create a Kubernetes TLS secret from your certificate and key. Domino’s NGINX ingress enforcesTLSv1.2 and TLSv1.3, using a FIPS-validated OpenSSL build. See Deploy Domino on AWS EKS, Deploy Domino on AKS, and Deploy Domino on GKE for certificate setup steps.
Intra-cluster communication
Intra-cluster encryption in transit is implemented, if enabled, through a deployed service mesh called Istio. At installation, Domino can deploy Istio for Domino use only, or you can configure Domino to use an existing Istio mesh on the Kubernetes cluster. See Control plane security and Work with CA certificates for configuration details.Encryption at rest
Project files
Domino supports server-side encryption with customer-provided keys (SSE-C) for Amazon S3, and EBS file system encryption using the AES-256 algorithm on Elastic Block Store. Domino also supports default encryption keys for Amazon S3, Azure File Storage, and Google Cloud Filestore. Domino does not provide pre-write encryption fornfs-client-provisioner volumes. See Manage Project file storage for details.
Secrets
Domino stores secrets in an instance of HashiCorp Vault. By default, Vault stores the following secrets encrypted at rest without additional configuration:- User environment variables
- User API keys
- Data Source access secrets
- Project environment variables