ADR-003: Fernet AES-256 Secret Encryption
- Status: Accepted
- Date: 2026-07-10
- Deciders: Security Team
Context
Meta WhatsApp API access tokens must be stored per tenant. Storing these tokens in plaintext in the database poses a major security risk in the event of a database compromise.
Decision
We enforce Fernet (AES-256 in CBC mode with HMAC SHA-256 authentication) for encrypting tenant secrets in .
TenantConfigConsequences
- Positive: Encrypted secrets at rest; plaintext tokens exist only transiently in memory.
- Negative: Requires careful management and backup of .
FERNET_KEY