Protection in layers
Traffic between supported clients and Taiega uses TLS. Production databases and object storage use managed encryption at rest. Sensitive provider credentials receive authenticated application-layer encryption before storage so a raw database value is not the usable token.
Server-side use
OAuth client secrets, refresh tokens, email credentials, encryption keys, and signing secrets belong in protected server environments. They are not embedded in browser bundles, returned through user-facing APIs, or included in data exports.
Rotation and revocation
Provider disconnection revokes or retires the stored connection. Production secrets and API keys should be rotated when staff access changes, an environment is replaced, or exposure is suspected. Audit events preserve the identity and time of privileged changes without recording the secret value.