Encryption

Search2o has builtin encryption that stores sensitive information in encrypted form. You can switch to end-to-end encryption for even more privacy.

Default: a key managed by Search2o

With encryptionSource set to cloud, Search2o keeps one key per account in a key management service. An agent server fetches the account's key over TLS when the server needs it and keeps the key in memory. The server encrypts and decrypts; the cloud only stores ciphertext and never decrypts your state. Nothing has to be set up, which is why this is the default. What this does not give you is exclusion of Search2o: the key exists on Search2o's side, so Search2o, and Google as the infrastructure provider, can in principle read what the key protects.

End-to-end: a key you hold

With encryptionSource set to client, the key never leaves your organization, and nobody outside your organization can read the state, the queries, the prompt profiles or the hosted secrets.

1. Write an async Python function that takes a key name and returns the key for that name, as 16, 24 or 32 bytes. The function may read a file, an environment variable, or a KMS; anything reachable from the agent server works.
2. Name the function in keyFunction by its dotted path, for example mycompany.keys.get_key. Each agent server imports the function from its own Python environment when the server builds its runtime, and reports a failed import in its log.
3. List the keys in keys, each with a name and a creation time. The last key in the list is the current key.

From then on the agent server calls your function for every key it needs. The settings are listed below.

Key rotation

Every encrypted value records the name of the key that encrypted it, so several keys can be in use at once. With client-held keys, rotation is adding a new key at the end of the list. The new key encrypts everything from then on. The older keys stay in the list, so that state encrypted under them can still be read. Nothing already stored has to be re-encrypted. An old key is needed for as long as anything encrypted under it is still alive: the plan's retention for a conversation, 7 days on Free and 90 days on Paid, longer for a pinned one, the life of the storing agent for a long-term memory, and the whole life of a hosted secret.

With the default setting, an administrator rotates the Search2o-managed key from the License page. Rotation issues a new key for the account, and everything already encrypted stays readable — nothing is re-encrypted. Two things to know: an agent server begins using the new key only when the server is restarted, and rotation does not protect data already written under a stolen key — rotation bounds future exposure. Rotation is available at most once every 90 days; if a key is known to be exposed, please contact support.

Switching to end-to-end encryption

Switch before the account holds data you care about. State encrypted under the cloud-managed key stays readable after the switch, and new state is encrypted under your key. Hosted secrets can be entered only once end-to-end encryption is in place.

What is encrypted

See Data privacy for the full list. The cipher is AES-GCM, and transport between the agent server and the cloud is always TLS.

Settings

The Encryption part is edited in the GUI under Operations › Secrets & encryption.

A key