Encryption at Rest vs in Transit: What Customers Will Ask

What you actually need to know

• Encryption at rest is table stakes. Turn it on at provisioning.
• TLS 1.2 minimum. TLS 1.3 preferred. Disable older versions.
• Internal service to service traffic should also be encrypted.
• Backups must be encrypted. Cross account storage adds protection.
• Customer managed keys are required for higher tier enterprise.

Surface

Encryption requirement

Application database

At rest, AWS or customer managed

Object storage

At rest, server side encryption

Backups

At rest, in a separate account

Public endpoints

TLS 1.2 or 1.3

Internal API calls

TLS or mTLS

Service mesh traffic

mTLS automated

Cache and queue

At rest where supported

Logs

At rest

The core argument

Encryption at rest and in transit are the two questions enterprise security teams ask first. The questions are easy to answer when both are properly configured. The questions are awkward when they are not. The teams that have not implemented either usually have not been through an enterprise security review yet. The review forces the conversation.

The implementation is straightforward in 2026. Managed databases support encryption at rest with AWS or customer managed keys. Load balancers terminate TLS with current versions. Object storage encrypts by default. Service meshes provide mTLS between internal services. The team configures these once and the controls run.

The discipline is in the audit. Verify every storage location is encrypted. Verify every endpoint uses current TLS. Verify the key management is separate from the data. Verify the audit log captures key use. Each verification is minutes. The combination is an encryption posture that survives security review.

The other discipline is in the documentation. The customer security questionnaire asks specifically about encryption. The team has to answer with specifics. Which encryption algorithm. Which key management. Which TLS versions. Which protocols on which ports. The documentation makes the answers fast.

The audit checklist

Item

Verify

Database encryption at rest

Provider confirms enabled

Object storage encryption

Bucket policy requires encryption

Backup encryption

Snapshots encrypted

Disk encryption on instances

EBS volumes encrypted

TLS on public endpoints

Minimum TLS 1.2, prefer 1.3

Older TLS disabled

TLS 1.0 and 1.1 off

Internal service to service

TLS or mTLS

Key management

Separate KMS with audit

Customer managed key support

If selling enterprise

Documentation

Specific answers for questionnaire

How much does this cost

Component

Cost

AWS managed encryption

Bundled with managed services

KMS key operations

Pennies per operation

Customer managed keys

Slight premium

Service mesh mTLS

Operational complexity

TLS certificates

Often free with Let's Encrypt or ACM

Documentation work

A few days for initial questionnaire answers

Features the encryption setup must have

• Encryption at rest enabled on every storage location.
• TLS 1.2 minimum on every endpoint.
• Internal service traffic encrypted.
• Separate key management with audit.
• Backup encryption and cross account storage.
• Documentation for the customer questionnaire.
• A regular audit cadence.
• An owner of the encryption posture.

Expert opinion

Encryption is the easiest part of an enterprise security review when the team has done the work. The implementations are well documented and largely automated in modern managed services. The teams that have not done the work stumble on the simplest questions. The fix is hours. The cost of skipping is the deal that stalls in security review.

Yashveer Singh, founder of Yashveer Labs

How this played out on a real project

A client SaaS was preparing for SOC 2 Type II. The security questionnaire from their first enterprise prospect arrived with detailed encryption questions. The team was not prepared.

We audited the posture. Database encryption was on. Object storage encryption was inconsistent. TLS configuration was outdated on one service. Internal traffic was unencrypted. Backups were in the same account as the primary.

We fixed each item over three weeks. Documented the answers. The questionnaire returned within a week. The customer's security team approved without follow up questions. The deal closed two weeks later.

For more on the related work, see customer managed encryption keys enterprise engineering and secrets management for SaaS Vault AWS Secrets Manager Doppler.

Common mistakes teams make

1. Encryption at rest not enabled on all storage.
2. Older TLS versions still accepted.
3. Internal traffic unencrypted.
4. Keys in the same account as the data.
5. No audit on key use.
6. Backups in the same account as the primary.
7. No documentation. Questionnaire answers are slow.
8. Treating encryption as the security program rather than as a starting point.

A one week audit and fix

1. Day one. Inventory storage locations. Verify encryption.
2. Day two. Inventory endpoints. Verify TLS versions.
3. Day three. Verify internal traffic encryption.
4. Day four. Verify key management is separate with audit.
5. Day five. Verify backups are encrypted and cross account.
6. Days six and seven. Document the posture for the customer questionnaire.

For more on the related work, read customer managed encryption keys enterprise engineering and the customer security questionnaire a strategic asset. On the broader compliance side, SOC 2 Type I vs Type II is the natural next read.

FAQ

Frequently asked

• What does encryption at rest actually mean?
• What does encryption in transit mean?
• Is the default encryption enough?
• What about backup encryption?
• What about TLS versions?
• What about internal service to service traffic?
• What is the worst mistake?

Author

Why Yashveer Singh is the call for this work

I have spent the last four years writing software that runs in production. Three live client sites. A Roblox game with real players. Nexli, a school management system about to launch into private testing. Nyxera, a fully local AI assistant. Most people writing about this topic are summarizing other people's blog posts. I am writing from the codebase. If you want this kind of work done right, I am the person you call. Yashveer Singh, founder of Yashveer Labs.

Start the conversation See the work DM on Instagram