Your portal credentials are the most sensitive thing you entrust to Elementar. This page explains exactly how they are protected — and includes a due-diligence answer sheet for your security and compliance teams.
Encrypted under a key that is yours alone
Each client's portal credentials are encrypted with a key derived uniquely for that client (PBKDF2-HMAC-SHA256 over a master key, with a per-tenant salt). One client's key cannot decrypt another client's data — not even inside Elementar's own systems.
Keys held in a dedicated key vault, never in the application
The master encryption key lives in Azure Key Vault and is retrieved at runtime only by an authorized managed identity. It is never stored in Elementar's application, environment, containers, or source code.
Authenticated encryption, never plaintext
Credentials are stored using authenticated encryption — Fernet (AES-128-CBC with HMAC-SHA256), which is tamper-evident. They are never written in plaintext. Documents and the database are additionally encrypted at rest with AES-256 on Microsoft Azure.
Least-privilege access, fully audited
Access to secrets follows least privilege — scoped per secret, not blanket — and every access to the key vault is logged to an audit trail.
Read-only access, MFA-protected login
Elementar connects to your portals read-only — no funds can ever move — and handles two-factor authentication automatically. Your Elementar login is protected by MFA, server-side session revocation, and brute-force throttling.
Your right to erasure
When you offboard, your stored credentials are cryptographically zeroized. Elementar operates under Swiss nFADP and EU GDPR.
Continuous dependency patching
Our software dependencies are continuously scanned for known vulnerabilities. High-severity fixes are applied promptly and validated by an automated test suite on a staging environment before reaching production.
European data residency, per-tenant isolation
All data is processed and stored exclusively in European Azure regions (EU and Switzerland). Elementar GmbH is Swiss-domiciled. Each client is a separate tenant with its own database and its own encryption key — no commingling between clients.
Due-diligence answer sheet
| Question | Answer |
|---|---|
| Credential storage at rest | Recoverable third-party portal credentials, encrypted with Fernet (AES-128-CBC + HMAC-SHA256) under per-tenant derived keys (PBKDF2-HMAC-SHA256, per-tenant salt). Credentials must be replayed into portals, so they are encrypted (not hash-only) — and never stored in plaintext. |
| Key management | Master key held in Azure Key Vault (Standard SKU, software-protected). Fetched at runtime via Azure managed identity; never in application config, environment variables, containers, or source. Per-tenant keys are derived in memory and not stored. An HSM-backed envelope is on the roadmap. |
| Can Elementar staff read credentials? | Credentials are decrypted only by automated processes, to perform the portal logins you authorize. A client-initiated credential reveal exists and is audited. Operational/break-glass access is restricted to least privilege and logged. |
| Encryption in transit | TLS 1.2 or higher. |
| Data residency | Processed and stored exclusively in EU and Switzerland Azure regions. Elementar GmbH is Swiss-domiciled, under nFADP and GDPR. |
| Tenant isolation | Per-tenant databases and per-tenant encryption keys. No cross-tenant decryption is possible. |
| Access control & audit | Least-privilege RBAC on the key vault, scoped per secret. Key Vault access is logged with retention. |
| Authentication | MFA on client logins, server-side token revocation, brute-force rate-limiting, modern signed tokens, and a CI secret-scanning gate that blocks secrets from entering the codebase. |
| Portal access scope | Read-only. No transactional capability — funds can never move. Two-factor authentication is handled automatically. |
| Credential lifecycle / erasure | On offboarding, stored credentials and tokens are cryptographically zeroized. |
| Incident response & DR | Documented credential-compromise and master-key break-glass / disaster-recovery runbooks. |
| Certifications | Elementar is not currently SOC 2 or ISO 27001 certified. |
| Network controls | Key Vault access is gated by Entra ID and RBAC. A private-network lock is on the roadmap. |
| Key rotation | Rotation capability is in place; a formal rotation cadence is being established. |
| Dependency patching | GitHub Dependabot monitors the dependency graph for known CVEs; high-severity alerts are remediated promptly and gated by automated tests on the preview deploy before reaching production. |