Encryption

Data in transit

All communication between clients and Rockhopper is encrypted with TLS 1.2 or higher. Unencrypted connections are never accepted.

Channel	Protocol
Web application	HTTPS (TLS 1.2+)
Excel add-in	HTTPS (TLS 1.2+)
Google Sheets sidebar	HTTPS (TLS 1.2+)
Real-time updates	WSS (TLS-encrypted WebSocket)
Microsoft Graph API	HTTPS (TLS 1.2+)
Google APIs	HTTPS (TLS 1.2+)

SSL certificates are managed and renewed automatically. All HTTP requests are redirected to HTTPS.

SSL certificate details for *.rockhopper.co

Data at rest

All persistent data is encrypted using AWS-managed encryption services:

Storage layer	Encryption
Database (PostgreSQL)	AWS RDS encryption with AES-256
Version snapshots (S3)	Server-side encryption (SSE-S3) with AES-256
Secrets and credentials	AWS Secrets Manager with KMS

S3 bucket encryption settings showing SSE-S3 with AES-256

Authentication tokens

Rockhopper uses OAuth 2.0 for authentication with Microsoft Entra ID and Google Identity. Microsoft access tokens are:

• Held in memory only during the user's active session

• Never persisted to disk, database, or browser storage by Rockhopper

• Transmitted exclusively over encrypted channels

Google OAuth refresh tokens are encrypted and stored in the database to maintain persistent file access for change tracking.