Encryption Standards

Document owner: Chief Information Security Officer (CISO) Version: 3.0 Effective date: January 1, 2026 Last updated: January 15, 2026 Classification: Public — Trust Center Review cadence: Annual, and upon NIST/CISA cryptographic guidance updates or material technology changes Company: Acme Cloud, Inc. Address: 1200 Market Street, Suite 400, San Francisco, CA 94103, USA Primary contacts: trust@acmecloud.com | security@acmecloud.com | privacy@acmecloud.com

---

Definitions

Term	Definition
AES	Advanced Encryption Standard, symmetric block cipher
Asymmetric Encryption	Encryption using public/private key pairs
Block Cipher	Encryption algorithm operating on fixed-size data blocks
CBC	Cipher Block Chaining, block cipher mode of operation
Certificate Authority (CA)	Entity issuing digital certificates
CMK	Customer Master Key, top-level key in AWS KMS hierarchy
Cryptographic Agility	Ability to switch cryptographic algorithms without major system changes
Data Encryption Key (DEK)	Symmetric key encrypting data directly
Digital Certificate	Electronic document binding public key to identity
ECDSA	Elliptic Curve Digital Signature Algorithm
Ed25519	Edwards-curve Digital Signature Algorithm using Curve25519
Envelope Encryption	Pattern using DEK encrypted by KEK
FIPS 140-2/3	Federal Information Processing Standard for cryptographic modules
GCM	Galois/Counter Mode, authenticated encryption mode
HKDF	HMAC-based Key Derivation Function
HMAC	Hash-based Message Authentication Code
HSM	Hardware Security Module, physical device for key protection
HSTS	HTTP Strict Transport Security
KEK	Key Encryption Key, key that encrypts other keys
Key Rotation	Process of retiring and replacing cryptographic keys
KMS	Key Management Service, system for managing encryption keys
mTLS	Mutual TLS, bidirectional certificate authentication
NIST	National Institute of Standards and Technology
OCSP	Online Certificate Status Protocol
Perfect Forward Secrecy (PFS)	Property ensuring session keys cannot be compromised by long-term key compromise
PKI	Public Key Infrastructure, framework for managing digital certificates
Post-Quantum Cryptography (PQC)	Cryptographic algorithms resistant to quantum computer attacks
RSA	Rivest-Shamir-Adleman, asymmetric encryption algorithm
Salt	Random data added before hashing to prevent rainbow table attacks
SHA	Secure Hash Algorithm family
Symmetric Encryption	Encryption using same key for encryption and decryption
TDE	Transparent Data Encryption, database-level encryption
TLS	Transport Layer Security, protocol for encrypted network communication
X.509	Standard for public key certificates

---

Scope and Applicability

1.1 Document Scope

This Encryption Standards document defines cryptographic requirements for all Acme Cloud, Inc. ("Acme Cloud") systems processing, storing, or transmitting information. Standards align with:

Standard/Framework	Alignment
NIST SP 800-57	Key management recommendations
NIST SP 800-131A	Cryptographic algorithm transitions
NIST SP 800-175B	Cryptographic standards selection
SOC 2 CC6.7	Encryption controls
ISO 27001 Annex A.10	Cryptographic controls
HIPAA §164.312	Technical safeguards (encryption)
GDPR Article 32	Security of processing
PCI DSS Requirement 3-4	Cardholder data protection

1.2 System Scope

System Category	Encryption Scope	Key Management
Production SaaS Platform	Full encryption requirements	AWS KMS
Production Databases	At-rest and in-transit encryption	AWS KMS CMK
Staging Environments	Same as production (with customer data)	AWS KMS
Development Environments	TLS for communication	Standard TLS
Corporate Systems	Disk encryption, TLS	Endpoint + cloud
Backup Systems	At-rest encryption	Separate KMS keys
DR Systems	Same as production	Cross-region KMS

1.3 Data Classification and Encryption Requirements

Classification	At Rest	In Transit	Application Layer	Key Management
Public	Optional	TLS 1.2+	Not required	Standard
Internal	AES-256 recommended	TLS 1.2+	Not required	AWS KMS
Confidential	AES-256 required	TLS 1.2+ required	Recommended for sensitive fields	AWS KMS CMK
Restricted	AES-256 + field-level	TLS 1.3 preferred	Required	CMK or customer-managed

---

Cryptographic Algorithm Standards

2.1 Symmetric Encryption Algorithms

Algorithm	Mode	Key Size	Approved Use	Prohibited Use	Sunset
AES-256	GCM	256-bit	All encryption at rest, field-level encryption	ECB mode	Active
AES-256	CBC + HMAC-SHA256	256-bit	Legacy migration only	New implementations	2027
AES-128	GCM	128-bit	Low-sensitivity transient data only	Database encryption, sensitive data	Active (limited)
ChaCha20-Poly1305	N/A	256-bit	Mobile SDK, streaming encryption	Server-side database encryption	Active
3DES	Any	Any	Prohibited	All use	Sunset 2023
DES	Any	Any	Prohibited	All use	Sunset 2000
RC4	N/A	Any	Prohibited	All use	Sunset 2015
Blowfish	Any	Any	Prohibited	All use	Sunset 2010

2.2 Asymmetric Encryption Algorithms

Algorithm	Key Size	Approved Use	Prohibited Use	Sunset
RSA	4096-bit	Legacy certificate migration, key exchange	New PKI, code signing	2027
RSA	2048-bit	Prohibited for new use	All new use	2025
RSA	< 2048-bit	Prohibited	All use	Sunset
ECDSA	P-384 (secp384r1)	Code signing, internal PKI, API signing	N/A	Active
ECDSA	P-256 (secp256r1)	TLS certificates, standard use	High-security applications	Active
Ed25519	256-bit	SSH keys, service authentication, signatures	N/A	Active
X25519	256-bit	Key exchange (TLS 1.3)	N/A	Active

2.3 Hashing Algorithms

Algorithm	Approved Use	Prohibited Use	Notes
SHA-256	General hashing, HMAC, integrity	Password hashing alone	Standard choice
SHA-384	High-security hashing, code signing	N/A	When SHA-256 insufficient
SHA-512	High-security hashing	N/A	Alternative to SHA-384
SHA-1	Prohibited for security	All security purposes	Legacy compatibility only
MD5	Prohibited	All security purposes	Checksums only (non-security)
BLAKE2b	Content addressing, high-performance	N/A	Approved for specific use cases
BLAKE3	High-performance hashing	N/A	Approved for specific use cases

2.4 Password Hashing Algorithms

Algorithm	Parameters	Approved Use	Notes
Argon2id	Memory: 64MB, Iterations: 3, Parallelism: 4	New password storage	Preferred
bcrypt	Cost factor: 12 minimum	Legacy password storage	Migration to Argon2id
scrypt	N: 32768, r: 8, p: 1	Alternative to Argon2id	Approved
PBKDF2	310,000 iterations (SHA-256)	Legacy systems only	Migrate to Argon2id
SHA-1/MD5	Any	Prohibited	Immediate migration required
Plaintext	N/A	Prohibited	Security incident if discovered

2.5 Key Derivation Functions

Function	Parameters	Approved Use
HKDF (RFC 5869)	SHA-256 or SHA-384	Deriving keys from shared secrets
Argon2id	As specified above	Password-based key derivation
PBKDF2	310,000 iterations minimum	Legacy key derivation
scrypt	As specified above	Password-based key derivation

---

Transport Layer Security

3.1 TLS Version Requirements

Protocol Version	Status	Use Case	Configuration
TLS 1.3	Preferred	All new connections, public endpoints	Primary
TLS 1.2	Approved	Backward compatibility	With approved cipher suites only
TLS 1.1	Prohibited	N/A	Blocked at load balancer
TLS 1.0	Prohibited	N/A	Blocked at load balancer
SSL 3.0	Prohibited	N/A	Blocked
SSL 2.0	Prohibited	N/A	Blocked

3.2 Approved TLS Cipher Suites

TLS 1.3 Cipher Suites (Preferred):

Cipher Suite	Key Exchange	Encryption	Hash	Status
TLS_AES_256_GCM_SHA384	ECDHE/DHE	AES-256-GCM	SHA-384	Preferred
TLS_CHACHA20_POLY1305_SHA256	ECDHE/DHE	ChaCha20-Poly1305	SHA-256	Approved
TLS_AES_128_GCM_SHA256	ECDHE/DHE	AES-128-GCM	SHA-256	Approved

TLS 1.2 Cipher Suites (Approved for compatibility):

Cipher Suite	Key Exchange	Encryption	Hash	Status
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	ECDHE-RSA	AES-256-GCM	SHA-384	Approved
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384	ECDHE-ECDSA	AES-256-GCM	SHA-384	Approved
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	ECDHE-RSA	AES-128-GCM	SHA-256	Approved
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256	ECDHE-ECDSA	AES-128-GCM	SHA-256	Approved
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	ECDHE-RSA	ChaCha20-Poly1305	SHA-256	Approved

Prohibited Cipher Suites:

Category	Examples	Reason
Non-PFS	RSA key exchange	No forward secrecy
CBC mode	CBC ciphers	Vulnerable to padding attacks
Export ciphers	EXPORT	Weak encryption
NULL ciphers	NULL	No encryption
Anonymous	anon	No authentication
RC4	RC4	Broken algorithm
DES/3DES	DES, 3DES	Weak/deprecated

3.3 Certificate Requirements

Certificate Type	Key Algorithm	Key Size	Validity	CA Requirement
Public TLS (customer-facing)	ECDSA P-256 or RSA	P-256 or 2048+ RSA	1 year maximum	Public CA (ACM)
Internal mTLS	ECDSA P-384	P-384	1 year	Internal PKI
Code signing	ECDSA P-384	P-384	2 years	Internal PKI
API signing	Ed25519	256-bit	1 year	Internal PKI

3.4 HTTP Security Headers

Header	Value	Purpose
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload	Force HTTPS
Content-Security-Policy	script-src 'self'; ...	Prevent XSS
X-Content-Type-Options	nosniff	Prevent MIME sniffing
X-Frame-Options	DENY	Prevent clickjacking
Referrer-Policy	strict-origin-when-cross-origin	Control referrer

---

Encryption at Rest

4.1 Database Encryption

Database	Encryption Method	Algorithm	Key Management	Verification
Amazon RDS (PostgreSQL)	Storage encryption (TDE)	AES-256	AWS KMS CMK	AWS Config rule
Field-level (sensitive)	Application encryption	AES-256-GCM	Tenant-specific DEKs	Application audit
Backups	Backup encryption	AES-256	Separate backup CMK	Backup policy

Field-Level Encryption Implementation:

Data Type	Encryption Required	DEK Scope	Examples
SSN/Tax ID	Required	Per-tenant	Social Security Number
Payment tokens	Required	Per-tenant	Stripe tokens
PHI fields	Required (BAA customers)	Per-tenant	Medical record numbers
API secrets	Required	Per-tenant	Integration credentials
PII (configurable)	Customer-configurable	Per-tenant	Email, phone

4.2 Object Storage Encryption

Storage Type	Encryption Method	Algorithm	Key	Verification
Amazon S3	SSE-KMS	AES-256	Per-bucket CMK	Bucket policy
S3 (backups)	SSE-KMS	AES-256	Dedicated backup CMK	Backup policy
S3 (logs)	SSE-KMS	AES-256	Logging CMK	Log configuration

S3 Bucket Policy Requirements:

Requirement	Implementation	Enforcement
Encryption required	Deny unencrypted uploads	Bucket policy
TLS required	Deny HTTP requests	Bucket policy
Versioning enabled	Object versioning	Bucket configuration
Access logging	S3 access logs	Bucket configuration

4.3 Block Storage Encryption

Storage Type	Encryption Method	Algorithm	Key	Verification
Amazon EBS	EBS encryption	AES-256	AWS managed or CMK	Launch template
Instance storage	EBS encryption	AES-256	AWS managed	AMI configuration
Root volumes	EBS encryption	AES-256	AWS managed	Launch template

4.4 Endpoint Encryption

Platform	Encryption Method	Algorithm	Key Management	Verification
macOS	FileVault 2	AES-256-XTS	Device TPM + MDM escrow	MDM compliance
Windows	BitLocker	AES-256	Device TPM + MDM escrow	MDM compliance
Linux	LUKS	AES-256-XTS	Device passphrase	Device policy
Mobile (iOS)	iOS encryption	AES-256	Secure Enclave	MDM compliance
Mobile (Android)	File-based encryption	AES-256	Device key	MDM compliance

---

Key Management

5.1 Key Management Architecture

Acme Cloud uses AWS Key Management Service (KMS) as the primary key management platform with the following hierarchy:

Key Level	Description	Storage	Rotation
Root keys	AWS KMS CMKs	AWS HSM (FIPS 140-2 Level 3)	Annual automatic
Key Encryption Keys (KEKs)	CMKs for encrypting DEKs	AWS KMS	Annual automatic
Data Encryption Keys (DEKs)	Keys encrypting data directly	Encrypted by KEK	Per-operation or periodic
Session keys	TLS session keys	Memory only	Per-session

5.2 Key Lifecycle Management

Phase	Requirements	Implementation	Verification
Generation	Cryptographically secure random	AWS KMS GenerateDataKey	KMS API audit
Distribution	Never transmit plaintext	Envelope encryption	Architecture review
Storage	Hardware-protected, access-controlled	AWS KMS, HSM-backed	KMS configuration
Use	Least privilege, audit logging	IAM policies, CloudTrail	Access reviews
Rotation	Scheduled, documented	Automatic KMS rotation	Rotation logs
Archival	Encrypted, access-controlled	N/A (KMS handles)	N/A
Destruction	Cryptographic erasure, 7-30 day wait	KMS ScheduleKeyDeletion	Deletion logs

5.3 Key Rotation Schedule

Key Type	Rotation Period	Rotation Method	Verification
KMS CMKs	365 days	Automatic KMS rotation	CloudTrail logs
Database DEKs	Per-write (envelope)	Automatic	Application logs
TLS certificates	60 days before expiry	ACM auto-renewal	Certificate monitoring
mTLS certificates	30 days before expiry	PKI auto-renewal	PKI monitoring
SSH keys	365 days	Manual rotation	Key inventory audit
API keys	90 days	Automated rotation	Secrets Manager logs
Service account credentials	90 days	Automated rotation	Secrets Manager logs

5.4 Key Access Controls

Role	KMS Permissions	Use Case
KMS Administrator	kms:Create*, kms:Put*, kms:Delete*, kms:Enable*, kms:Disable*	Key management
Application	kms:Encrypt, kms:Decrypt, kms:GenerateDataKey	Data encryption
Auditor	kms:Describe*, kms:List*, kms:Get*	Compliance review
Security	kms:* (scoped to security keys)	Security operations

5.5 Customer-Managed Keys (Enterprise)

Enterprise customers may bring their own keys (BYOK):

CMK Feature	Implementation	Customer Responsibility
Key provision	Customer creates CMK, grants Acme Cloud access	Key creation, IAM policy
Cross-account access	IAM role assumption	Grant Acme Cloud IAM role
Key rotation	Customer-managed	Rotation configuration
Key revocation	Remove IAM grant	Immediate data access loss
Audit	CloudTrail in customer account	Log monitoring

CMK Provisioning Process:

Step	Action	Owner
1	Customer creates KMS CMK	Customer
2	Customer configures key policy	Customer
3	Customer grants Acme Cloud IAM role access	Customer
4	Acme Cloud validates key access	Acme Cloud
5	Acme Cloud configures tenant to use CMK	Acme Cloud
6	Data encrypted with customer CMK	Acme Cloud

---

Certificate Management

6.1 Certificate Inventory

Certificate Type	Issuer	Validity	Renewal Automation
Public TLS (*.acmecloud.com)	AWS ACM	13 months	Automatic (60 days)
Internal mTLS	Acme Cloud Internal CA	1 year	Automatic (30 days)
Code signing	Acme Cloud Internal CA	2 years	Manual (60 days)
SAML signing	Acme Cloud Internal CA	3 years	Manual (90 days)

6.2 Certificate Lifecycle

Phase	Process	Automation	Monitoring
Issuance	CSR generation, CA signing	Terraform + ACM/PKI	Inventory update
Deployment	Certificate installation	Terraform + config management	Deployment verification
Monitoring	Expiration tracking	Certificate monitoring	60/30/14/7-day alerts
Renewal	New certificate issuance	Automatic for ACM	Renewal verification
Revocation	CRL/OCSP update	Manual process	Revocation verification
Expiration	Certificate removal	Prevented by monitoring	Expiration alerts

6.3 Certificate Revocation

Revocation Trigger	Response Time	Process
Key compromise	Immediate	Emergency rotation, incident response
Employee departure	24 hours	Certificate revocation, CRL update
Service decommission	Planned	Certificate revocation
Algorithm deprecation	Per timeline	Planned migration

---

Cryptographic Incident Response

7.1 Cryptographic Incidents

Incident Type	Severity	Response	Notification
Key compromise	SEV1	Immediate rotation, forensics	Customer within 24 hours
Algorithm vulnerability	Varies	Assess impact, plan migration	Advisory if affected
Certificate compromise	SEV1	Immediate revocation	Customer within 24 hours
Weak encryption discovered	SEV2	Remediation plan	Internal escalation
Encryption failure	SEV2	Investigation, remediation	Customer if data affected

7.2 Key Compromise Response (IR-CRYPTO-001)

Step 1: Detection and Confirmation (0-30 minutes) 1.1. Alert received or compromise reported 1.2. Initial assessment and severity classification 1.3. Incident commander assigned

Step 2: Containment (0-2 hours) 2.1. Isolate affected systems if necessary 2.2. Rotate compromised keys immediately 2.3. Revoke associated certificates 2.4. Update access controls

Step 3: Assessment (2-24 hours) 3.1. Determine scope of compromise 3.2. Identify affected data 3.3. Preserve forensic evidence 3.4. Assess regulatory notification requirements

Step 4: Remediation (24-72 hours) 4.1. Complete key rotation across all affected systems 4.2. Re-encrypt affected data if necessary 4.3. Deploy additional controls 4.4. Verify remediation effectiveness

Step 5: Recovery and Reporting (72 hours - 5 days) 5.1. Confirm normal operations 5.2. Complete incident report 5.3. Conduct post-incident review 5.4. Implement lessons learned

---

Post-Quantum Cryptography Readiness

8.1 PQC Transition Strategy

Acme Cloud is preparing for the transition to post-quantum cryptography:

Phase	Timeline	Activities
Assessment	2025-2026	Cryptographic inventory, dependency mapping
Planning	2026-2027	Migration planning, hybrid protocol testing
Pilot	2027-2028	Hybrid PQC deployment for internal services
Migration	2028-2030	Production PQC deployment

8.2 PQC Algorithm Roadmap

Algorithm	NIST Status	Acme Cloud Plan	Target Use Case
ML-KEM (Kyber)	Standardized (FIPS 203)	Pilot 2027	Key encapsulation
ML-DSA (Dilithium)	Standardized (FIPS 204)	Pilot 2027	Digital signatures
SLH-DSA (SPHINCS+)	Standardized (FIPS 205)	Evaluation	Stateless signatures
Hybrid TLS	In development	Pilot 2027	Transport security

8.3 Cryptographic Agility Preparation

Preparation Area	Current State	Target State
Algorithm abstraction	Partial	Full abstraction layer
Key length flexibility	Fixed in some systems	Configurable
Protocol versioning	TLS version negotiation	Algorithm negotiation
Testing capability	Manual	Automated algorithm testing

---

Compliance Monitoring

9.1 Encryption Compliance Checks

Check	Scope	Frequency	Tool
TLS configuration	All endpoints	Continuous	SSL Labs, Datadog
Certificate expiration	All certificates	Daily	Certificate monitoring
S3 encryption	All buckets	Continuous	AWS Config
EBS encryption	All volumes	Continuous	AWS Config
RDS encryption	All databases	Continuous	AWS Config
Secrets rotation	All secrets	Weekly	Secrets Manager audit

9.2 Compliance Dashboards

Dashboard	Content	Audience	Update Frequency
Encryption Compliance	Overall encryption status	Security Leadership	Daily
Certificate Status	Certificate inventory, expiration	Security Operations	Real-time
Key Rotation	Rotation compliance	Security Operations	Weekly
Vulnerability Status	Cryptographic vulnerabilities	Security Engineering	Daily

9.3 Audit Evidence

Evidence Type	Source	Retention	Audit Use
KMS audit logs	CloudTrail	7 years	SOC 2, ISO 27001
TLS configuration	SSL Labs scans	1 year	Penetration testing
Certificate inventory	PKI system	Current + 1 year	Compliance review
Encryption settings	AWS Config	7 years	SOC 2, ISO 27001
Rotation records	Secrets Manager	7 years	SOC 2, ISO 27001

---

Developer Guidelines

10.1 Approved Cryptographic Libraries

Language	Library	Use Case	Version
Node.js	crypto (built-in)	General cryptography	Current LTS
Node.js	@aws-sdk/client-kms	KMS operations	Latest
Node.js	argon2	Password hashing	0.31+
Python	cryptography	General cryptography	41.0+
Python	boto3	KMS operations	Latest
Go	crypto (standard library)	General cryptography	Current
Go	aws-sdk-go-v2	KMS operations	Latest

10.2 Prohibited Practices

Practice	Reason	Correct Approach
Hardcoded secrets	Exposure risk	Use Secrets Manager
Custom crypto algorithms	Likely insecure	Use approved libraries
ECB mode	Pattern leakage	Use GCM or CBC+HMAC
MD5/SHA-1 for security	Collision vulnerabilities	Use SHA-256+
Plaintext password storage	Direct exposure	Use Argon2id
Static IVs/nonces	Breaks encryption	Generate random per operation
Key in source code	Version control exposure	Use KMS
Self-signed certs (production)	Trust issues	Use CA-issued

10.3 Code Review Checklist

Review Item	Pass Criteria
Secrets handling	No hardcoded secrets, proper injection
Algorithm selection	Approved algorithms only
Key management	KMS or approved vault
Random generation	Cryptographically secure source
TLS configuration	Approved cipher suites
Password handling	Approved hashing algorithm
Certificate validation	Proper chain verification

---

Framework Mapping Appendix

SOC 2 Trust Services Criteria Mapping

TSC	Control	Acme Cloud Implementation	Evidence
CC6.1	Encryption keys protected	KMS with IAM controls	KMS policies
CC6.7	Data encrypted in transit	TLS 1.2+, mTLS	TLS configuration
CC6.7	Data encrypted at rest	AES-256, KMS	Encryption settings
CC6.7	Encryption key management	KMS lifecycle, rotation	Rotation logs

ISO 27001 Annex A Mapping

Control	Acme Cloud Implementation	Evidence
A.10.1.1	Cryptographic controls policy	This document
A.10.1.2	Key management	KMS, rotation, destruction
A.13.2.1	Network security controls	TLS requirements
A.14.1.2	Application security	Secure coding guidelines
A.14.1.3	System protection	Encryption requirements

NIST SP 800-53 Mapping

Control	Acme Cloud Implementation	Evidence
SC-8	Transmission confidentiality	TLS 1.2+
SC-12	Key management	KMS, key lifecycle
SC-13	Cryptographic protection	Approved algorithms
SC-17	PKI certificates	Certificate management
SC-28	Protection at rest	AES-256 encryption

HIPAA Technical Safeguards Mapping

HIPAA Section	Requirement	Acme Cloud Implementation	Evidence
§164.312(a)(2)(iv)	Encryption (addressable)	AES-256 at rest	Encryption settings
§164.312(e)(1)	Transmission security	TLS 1.2+	TLS configuration
§164.312(e)(2)(ii)	Encryption (transmission)	TLS for PHI	Network architecture

---

Related Trust Center documents

security overview, access control, backup recovery, data retention, hipaa statement, penetration testing

Document revision history

Version	Date	Author	Summary of changes
1.0	2024-06-01	Legal & Compliance	Initial Trust Center publication
2.0	2025-03-15	GRC Program	SOC 2 Type II alignment refresh; expanded subprocessors
2.5	2025-09-01	Security Engineering	Encryption standards update; ISO 27001 mapping
3.0	2026-01-15	Trust Center Program	Full procurement-grade expansion; 34-document set

Contact

Acme Cloud, Inc. 1200 Market Street, Suite 400 San Francisco, CA 94103, USA

Channel	Email	Use case
Trust & procurement	trust@acmecloud.com	Security questionnaires, trust reviews
Security	security@acmecloud.com	Incidents, vulnerabilities, control questions
Privacy	privacy@acmecloud.com	DSRs, privacy assessments
Legal	legal@acmecloud.com	Contractual, DPA, legal notices