> ## Documentation Index
> Fetch the complete documentation index at: https://launchdarkly-preview.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# LaunchDarkly in environments requiring FIPS 140-2 validated encryption modules

> This topic explains how customers can use LaunchDarkly in environments that require that all data is encrypted in transit using FIPS 140-2 validated encryption modules.

> For the complete documentation index, see [llms.txt](/llms.txt). For the full documentation snapshot, see [llms-full.txt](/llms-full.txt).

## Overview

In some customer environments, notably those serving the US government community, there may be compliance requirements to use
[FIPS 140-2](https://csrc.nist.gov/publications/detail/fips/140/2/final) validated encryption modules. This topic explains how customers can use LaunchDarkly in environments that require that all data is encrypted in transit using FIPS 140-2 validated encryption modules.

To comply with these requirements, customers must:

* Use the [LaunchDarkly federal environment](/home/infrastructure/federal).
* Use FIPS 140-2 validated encryption modules for any data transmission. One such module is [BoringCrypto](https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3678.pdf). It is a fork of OpenSSL that is maintained by Google, and allows for Golang applications to use FIPS 140-2 validated encryption, in place of the standard Golang crypto libraries.

<Warning title="Complying with regulatory requirements is the customer's responsibility">
  While this topic guides you in meeting your compliance needs, it is up to you to ensure that your encryption practices are documented in your SSP and are reviewed by your auditors, to ensure they are applicable and sufficient to your particular needs.
</Warning>

## SDKs

Because the LaunchDarkly SDKs are bundled into your applications, they should inherit the encryption modules used by your application.

For example, in Golang, you can use the `boringcrypto` [experiment flag](https://pkg.go.dev/internal/goexperiment) when building your Go (1.19+) code. The [Relay Proxy](/sdk/relay-proxy) is a great example of such an application, written in Go, using the LaunchDarkly Go SDK.

## Relay Proxy

To build the [LaunchDarkly Relay Proxy](https://github.com/launchdarkly/ld-relay) using BoringCrypto, run:

<CodeGroup>
  ```bash title="Shell" theme={null}
      GOEXPERIMENT=boringcrypto go build .
  ```
</CodeGroup>

Use this instead of running `make` or `go build .` to build the Relay Proxy with FIPS 140-2 encryption.

### Verification

To verify that a Go binary was indeed built with BoringCrypto, there are two methods you can use.

One method is to call `go version` and check the **Experiments** list. For example, here's how to check a binary called `ld-relay`:

<CodeGroup>
  ```bash title="Shell" theme={null}
          $ go version ld-relay
          ld-relay: go1.19 X:boringcrypto
  ```
</CodeGroup>

The `X:boringcrypto` indicates that this binary includes the FIPS 140-2 validated encryption modules.

The other method is to examine the symbol table in the binary, looking for BoringCrypto symbols:

<CodeGroup>
  ```bash title="Shell" theme={null}
      $ go tool nm ld-relay | grep _Cfunc__goboringcrypto_
  ```
</CodeGroup>

If this command returns results and a `0` exit code, then the binary includes the FIPS 140-2 validated encryption modules.

## Code references

If you are using [code references](/home/flags/code-references) you will need to build the [ld-find-code-refs](https://github.com/launchdarkly/ld-find-code-refs)
binary similarly.