Encryption keys for both in-transit and at-rest encryption are securely managed. SSL & TLS private keys for in-transit encryption are managed through our certificate provider. Volume and field-level encryption keys for at-rest encryption are stored in a hardened Key Management System that uses HSMs validated to FIPS 140-2. Keys are rotated, and the frequency varies by the type of key and the sensitivity of the key and the data it protects.