Cómo pensamos el cifrado de PII en una app Ionic + Angular, para cumplir el RGPD y la LOPD-GDD
Envelope encryption con clave por usuario, qué se cifra y qué no, cómo lo puso a prueba una auditoría externa, y el incidente de rendimiento que provocó nuestro propio hardening de seguridad. Montaste tu app con IA rápido: le pides unos datos al usuario, llamas al modelo, guardas el resultado en la base de datos y a producción. Cómodo, sin complicaciones. Hasta que un día miras bien qué estás…
Cuentopia creates customized bedtime stories for children using AI, with data provided by parents about their child's character, fears, and family situations. This data is sensitive and falls under the category of especially protected personal data under GDPR and LOPD-GDD. To protect this data, Cuentopia implemented envelope encryption with a master key stored in Google Cloud KMS and a user-specific key to encrypt sensitive fields before they reach the database.
The encryption process ensures that only the necessary fields are decrypted in memory, and the database only sees encrypted text. The design criteria for what to encrypt and what not to encrypt are based on whether the data is public or private. Public content, such as public stories in the catalog, is stored in plain text, while private content, like child profiles and private stories, is encrypted.
This approach allows for secure reading by default, as unencrypted documents are automatically treated as plaintext alongside encrypted private content. The encryption architecture uses Firebase Firestore for data storage, Cloud Functions for server-side logic, and Google Cloud KMS for the master key.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
