Is my data encrypted?

In transit: yes. Everything between your browser and Coasting goes over HTTPS, and browsers are told to refuse plain http for a year after their first visit. Your team's passwords are never stored - only a bcrypt hash, which cannot be turned back into the password.

Backups: yes. The nightly copy of the database is stored encrypted with AES-256 at Backblaze B2, our backup provider.

The live database disk: not encrypted, and you should know that rather than assume it.

Here is what that does and does not mean. Disk encryption protects against one thing: somebody physically taking the drive out of the machine. Coasting does not run on a computer in an office - it runs on a virtual server in a commercial data centre, so that scenario is a break-in at a hosting facility rather than someone walking past a desk. We have not audited that facility ourselves and we are not going to quote you compliance badges we have not seen.

What disk encryption does NOT protect against is somebody getting into the running server, because at that point the disk is already unlocked. That is the risk that actually matters, and it is handled by a locked-down machine and a very short list of people who can reach it.

We would rather tell you exactly where the line is than write "bank-level encryption" and leave you to discover what it covered. If encryption at rest on the live database is something you must have on paper, ask us - we are working on it and we will tell you straight where it stands.