Yes, all customer data is encrypted at rest and in transit. 

Data at rest

Customer data at rest is encrypted with AES-256:

• Database (Amazon DynamoDB): all tables use DynamoDB server-side encryption (AES-256) with keys managed by AWS KMS. Point-in-time recovery is enabled on production tables.
• File storage (Amazon S3): templates and generated documents are stored with S3 server-side encryption (SSE-S3, AES-256). All public access is blocked on every bucket. Generated documents in our processing storage are deleted automatically after 1 day.
• Credentials: OAuth tokens (monday.com, and Google or Microsoft when a customer connects an email account) are also encrypted at the application level with a dedicated customer-managed AWS KMS key, with automatic key rotation, before they are stored. They are only decrypted in memory when a request needs them.
• E-signature: the DocuGen Sign service runs in a separate, isolated AWS account, with the same encryption controls.
• Keys: all encryption keys are held in AWS KMS, which uses FIPS 140 validated hardware security modules. No keys are stored in our code or on our servers.

Data in transit

Data in transit is encrypted with HTTPS (TLS), including all calls between DocuGen and the monday.com API.