{
  "title": "Cryptographic key inventory",
  "generatedOn": "2026-08-28",
  "reviewedBy": {
    "role": "Change Manager",
    "person": "Alessandro Ferrante"
  },
  "rules": {
    "keyRotationDays": 365,
    "minimumTlsVersion": "1.2",
    "preferredTlsVersion": "1.3",
    "certificateExpiryAlertDays": 30
  },
  "keys": [
    {
      "name": "Backup encryption key",
      "purpose": "Encrypts the off-site copy of customer backups",
      "algorithm": "AES-256",
      "system": "Backup console",
      "ownerRole": "Service Desk Lead",
      "ownerPerson": "Lotte van Dijk",
      "createdOn": "2026-07-19",
      "nextRotationOn": "2027-07-19",
      "recoveryControl": "two-person",
      "status": "active"
    },
    {
      "name": "Laptop disk recovery keys",
      "purpose": "Recovers a managed laptop whose owner lost the passphrase",
      "algorithm": "AES-256",
      "system": "Endpoint management",
      "ownerRole": "Service Desk Lead",
      "ownerPerson": "Lotte van Dijk",
      "createdOn": "2026-06-14",
      "nextRotationOn": "2027-06-14",
      "recoveryControl": "single custodian",
      "status": "active"
    },
    {
      "name": "Customer hosting database key",
      "purpose": "Encrypts the databases of the hosting platform at rest",
      "algorithm": "AES-256",
      "system": "Hosting platform",
      "ownerRole": "Change Manager",
      "ownerPerson": "Alessandro Ferrante",
      "createdOn": "2026-05-10",
      "nextRotationOn": "2027-05-10",
      "recoveryControl": "single custodian",
      "status": "active"
    },
    {
      "name": "Secrets vault master key",
      "purpose": "Unseals the vault that holds service credentials",
      "algorithm": "AES-256",
      "system": "Secrets vault",
      "ownerRole": "Change Manager",
      "ownerPerson": "Alessandro Ferrante",
      "createdOn": "2026-04-05",
      "nextRotationOn": "2027-04-05",
      "recoveryControl": "two-person",
      "status": "active"
    },
    {
      "name": "Log archive key",
      "purpose": "Encrypts the archive of security logs",
      "algorithm": "AES-256",
      "system": "Log archive",
      "ownerRole": "ISMS Manager",
      "ownerPerson": "Sam de Vries",
      "createdOn": "2026-03-01",
      "nextRotationOn": "2027-03-01",
      "recoveryControl": "single custodian",
      "status": "active"
    },
    {
      "name": "Internal tools signing key",
      "purpose": "Signs the scripts the engineers run on customer systems",
      "algorithm": "RSA-3072",
      "system": "Build server",
      "ownerRole": "Change Manager",
      "ownerPerson": "Alessandro Ferrante",
      "createdOn": "2026-01-25",
      "nextRotationOn": "2027-01-25",
      "recoveryControl": "single custodian",
      "status": "active"
    },
    {
      "name": "Mail signing key",
      "purpose": "Signs outgoing mail of the service desk",
      "algorithm": "RSA-3072",
      "system": "Mail gateway",
      "ownerRole": "Service Desk Lead",
      "ownerPerson": "Lotte van Dijk",
      "createdOn": "2025-12-21",
      "nextRotationOn": "2026-12-21",
      "recoveryControl": "single custodian",
      "status": "active"
    },
    {
      "name": "Monitoring agent key",
      "purpose": "Authenticates the agents on customer devices to the console",
      "algorithm": "AES-256",
      "system": "Remote monitoring console",
      "ownerRole": "Service Desk Lead",
      "ownerPerson": "Lotte van Dijk",
      "createdOn": "2025-11-16",
      "nextRotationOn": "2026-11-16",
      "recoveryControl": "single custodian",
      "status": "active"
    }
  ],
  "certificates": [
    {
      "name": "Customer portal",
      "tlsVersion": "1.3",
      "expiresOn": "2026-12-26",
      "alertDaysBefore": 30,
      "ownerRole": "Change Manager"
    },
    {
      "name": "Remote access gateway",
      "tlsVersion": "1.3",
      "expiresOn": "2027-02-14",
      "alertDaysBefore": 30,
      "ownerRole": "Change Manager"
    },
    {
      "name": "Mail gateway",
      "tlsVersion": "1.2",
      "expiresOn": "2027-04-05",
      "alertDaysBefore": 30,
      "ownerRole": "Change Manager"
    },
    {
      "name": "Internal portal",
      "tlsVersion": "1.3",
      "expiresOn": "2027-05-25",
      "alertDaysBefore": 30,
      "ownerRole": "Change Manager"
    }
  ]
}