•FOCUSCurrently working on ScheduleSomething and LayerdEvents algorithmsLearn More

Git Context • Architecture Decisions

ADR 003: Fernet Secret Encryption

Docsgit-contextArchitecture DecisionsADR 003: Fernet Secret Encryption

GitHub Live Sync

ADR 003: Fernet Secret Encryption

Live technical documentation fetched from GitHub repository omghante/metapilot/docs/adr/ADR-003-fernet-secret-encryption.md

ADR-003: Fernet AES-256 Secret Encryption

Status: Accepted
Date: 2026-07-10
Deciders: Security Team

Context

Meta WhatsApp API access tokens must be stored per tenant. Storing these tokens in plaintext in the database poses a major security risk in the event of a database compromise.

Decision

We enforce Fernet (AES-256 in CBC mode with HMAC SHA-256 authentication) for encrypting tenant secrets in

TenantConfig

Consequences

Positive: Encrypted secrets at rest; plaintext tokens exist only transiently in memory.
Negative: Requires careful management and backup of
```
FERNET_KEY
```
.