Security and Operations FAQ
Answers to the security and operations questions most often asked by security reviewers and procurement teams. General product questions are in the FAQ.
Security
Where are the CA private keys kept?
In dedicated FIPS 140-3 Level 3 HSMs in the EC datacenter. Keys are generated inside the HSM, never exported in plain form, and every signature is produced inside the HSM.
Who at EC can access the CAs and HSMs?
Only named, background-checked EC staff, with multi-factor authentication and separation of duties. Sensitive operations need dual control, and key activation or recovery needs an M-of-N quorum of key custodians. See Access Control Policy.
Is customer data encrypted at rest and in transit?
Connections to the portal, API and EC endpoints use TLS. Data at rest, including the CA database, portal database and backups, is encrypted with AES-256 using Azure storage and disk encryption, with keys managed by EC.
How are vulnerabilities and patches managed?
EC scans the hosted components for vulnerabilities regularly and applies patches according to severity under its change management process. Critical security fixes may be applied as emergency changes.
Is multi-factor authentication available for the portal?
Yes, through Single Sign-On with the customer's identity provider, which applies the customer's own MFA policy. MFA can also be enabled for local portal accounts and is recommended.
Are audit logs protected against change?
Every portal action is recorded with the user, time, action and result, and full CA auditing (AuditFilter 127) is enabled. Logs are read-only for all portal users, including Admins, and cannot be edited or deleted from the portal.
Is customer data used for development or testing?
No. Customer production data is never used for development or testing.
Operations
What is the availability commitment?
99.5% per month, excluding planned maintenance. See Service Level Agreements.
How often is data backed up and how long are backups kept?
CA databases and configuration are backed up regularly and key material is backed up in protected HSM form. Frequency and retention are defined in the subscription agreement. See Business Continuity and Disaster Recovery.
What are the RTO and RPO?
They are defined in the subscription agreement. See Business Continuity and Disaster Recovery.
Where is the service hosted?
See Hosting Locations and Data Residency.
Which IP addresses and host names must we allow?
See Network Endpoints and Allow-listing.
How long are logs kept, and can we send them to our SIEM?
See Log Export and SIEM Integration.
How are maintenance and upgrades handled?
Planned maintenance is announced to named contacts in advance. See Maintenance and Upgrades.
What happens to our keys and data if we leave?
See Termination and Exit.
Can we receive security questionnaires and evidence?
Yes. Contact EC Support or the customer's EC engagement lead. The evidence available on request is the Certificate Practice Statement (CPS), key ceremony records, and the FIPS 140-3 validation details of the HSMs.
Does EC hold its own certifications?
See the EC certifications section in Compliance Overview.