Protecting your data is our highest priority. We employ state-of-the-art encryption technologies to ensure that your sensitive information - particularly OAuth tokens for Google services - is protected at all times.
We use Fernet, a highly secure symmetric encryption from the Python Cryptography library. Fernet combines two proven cryptographic methods:
| Component | Algorithm | Purpose |
|---|---|---|
| Encryption | AES-128-CBC | Data confidentiality |
| Authentication | HMAC-SHA256 | Integrity and authenticity |
| Key Length | 256 Bit (32 Bytes) | High security margin |
Fernet is an "authenticated encryption" standard that provides both encryption and tamper protection. It is impossible to modify encrypted data without detection.
The encryption key is never stored directly. Instead, it is derived on-demand from three components:
A 64-character SHA256 hash uniquely generated for each user at registration.
A server-level secret key known only to the system.
The unique database ID of the user as an additional entropy factor.
"{user_secret}:{app_secret}:{user_id}"SHA256(combined) # 32 bytesBase64(key_hash) # Fernet-compatible
Even in the event of unauthorized database access, tokens remain protected because the application secret token is not stored in the database. Without all three components, decryption is mathematically impossible.
Short-lived access tokens for API requests
Long-lived tokens for access renewal
Authentication data for Google services
| Property | Status | Description |
|---|---|---|
| Encryption at Rest | Yes | All tokens in the database are encrypted |
| Encryption in Transit | Yes | TLS 1.3 for all connections |
| Individual Keys per User | Yes | Key compromise affects only one user |
| Keys Not Stored | Yes | Keys are derived on-demand |
| Integrity Verification | Yes | HMAC prevents undetected tampering |
Our encryption implementation complies with the following standards and best practices:
And more than secure enough for real business data.
128-bit AES encryption has been an international standard for years. Not theoretically, but proven in practice. Banks, cloud providers, and government agencies rely on exactly this.
A brute force attack on AES-128 would take longer than the age of the universe, even with today's computing power. There is no known realistic attack that can break AES-128.
Security doesn't depend on bit count alone. What matters is the implementation.
In our case, this means:
The difference to 256-bit is mostly academic in practice. 128-bit AES is not a compromise, but a deliberate, proven security standard.
Data protection is not a marketing buzzword for us, but a technical responsibility.
Security comes not from buzzwords, but from clean architecture. That's exactly what we're building with visibly AI.
For questions about our security measures, please contact our Data Protection Officer:
Email: info@antonioblago.com
Last updated: 2026-03-15