Encryption at Rest and in Transit
Encryption in transit protects data while it moves between systems, usually with TLS. Encryption at rest protects data while it is stored on disks or in databases, often with AES-256. Vendors describe both in their security terms.
What is encryption at rest and in transit?
Encryption scrambles data so only someone with the right key can read it. Security terms usually split it into two promises.
- In transit: data is protected while it moves, for example from your browser to the vendor. The usual method is TLS, the technology behind the padlock in your browser.
- At rest: data is protected while it is stored on disks, in databases or in backups. AES-256 is a common standard.
What it looks like in a vendor's terms
A typical clause reads like this:
We encrypt customer data in transit over public networks using TLS 1.2 or higher, and at rest using AES-256 or an equivalent standard.
- Over public networks: traffic inside the vendor's own network may not be covered.
- TLS 1.2 or higher: older, weaker versions are excluded.
- Or an equivalent standard: leaves room for the vendor to change methods.
Atlassian's Security Measures, for example, promise "encryption of Customer Data at rest using AES-256," and TLS 1.2 or higher over public networks.
Why it matters to you
This is one of the first questions on any security questionnaire your customers send you. You answer it for your vendors as much as for yourself.
Encryption at rest is not the whole story. If the vendor holds the keys, its staff, its subprocessors or anyone who gets into its systems with valid access may still read your data. And encryption is often a customer duty too: a SOC report may expect you to send data to the vendor encrypted.
What to check
- Find the promise in the security addendum or TOMs, not only on a marketing page.
- Check that it covers backups and every product you use.
- Ask who manages the keys, and whether you can bring your own.
- Check whether the clause lets the vendor change methods without notice.
How Venpo helps
Venpo monitors your vendors' security addenda, DPAs and trust center pages, and emails you in plain English when an encryption or security commitment changes. You see what was removed as well as what was added.
Frequently asked questions
Is AES-256 encryption enough?
AES-256 is a strong, widely used standard. What matters more is who holds the keys and whether the encryption covers backups and every place your data is stored.
What is end-to-end encryption?
Data is encrypted on the sender's device and decrypted only on the recipient's, so the vendor in the middle cannot read it. Most SaaS tools do not work this way.
Related terms
Sources
Last reviewed