Encryption at Rest vs in Transit: What Customers Will Ask

What you actually need to know

• Encryption at rest is table stakes. Turn it on at provisioning.
• TLS 1.2 minimum. TLS 1.3 preferred. Disable older versions.
• Internal service to service traffic should also be encrypted.
• Backups must be encrypted. Cross account storage adds protection.
• Customer managed keys are required for higher tier enterprise.

The core argument

Encryption at rest and in transit are the two questions enterprise security teams ask first. The questions are easy to answer when both are properly configured. The questions are awkward when they are not. The teams that have not implemented either usually have not been through an enterprise security review yet. The review forces the conversation.

The implementation is straightforward in 2026. Managed databases support encryption at rest with AWS or customer managed keys. Load balancers terminate TLS with current versions. Object storage encrypts by default. Service meshes provide mTLS between internal services. The team configures these once and the controls run.

The discipline is in the audit. Verify every storage location is encrypted. Verify every endpoint uses current TLS. Verify the key management is separate from the data. Verify the audit log captures key use. Each verification is minutes. The combination is an encryption posture that survives security review.

The other discipline is in the documentation. The customer security questionnaire asks specifically about encryption. The team has to answer with specifics. Which encryption algorithm. Which key management. Which TLS versions. Which protocols on which ports. The documentation makes the answers fast.

The audit checklist

How much does this cost

Features the encryption setup must have

• Encryption at rest enabled on every storage location.
• TLS 1.2 minimum on every endpoint.
• Internal service traffic encrypted.
• Separate key management with audit.
• Backup encryption and cross account storage.
• Documentation for the customer questionnaire.
• A regular audit cadence.
• An owner of the encryption posture.

Expert opinion

Encryption is the easiest part of an enterprise security review when the team has done the work. The implementations are well documented and largely automated in modern managed services. The teams that have not done the work stumble on the simplest questions. The fix is hours. The cost of skipping is the deal that stalls in security review.

>

Yashveer Singh, founder of Yashveer Labs

How this played out on a real project

A client SaaS was preparing for SOC 2 Type II. The security questionnaire from their first enterprise prospect arrived with detailed encryption questions. The team was not prepared.

We audited the posture. Database encryption was on. Object storage encryption was inconsistent. TLS configuration was outdated on one service. Internal traffic was unencrypted. Backups were in the same account as the primary.

We fixed each item over three weeks. Documented the answers. The questionnaire returned within a week. The customer's security team approved without follow up questions. The deal closed two weeks later.

For more on the related work, see customer managed encryption keys enterprise engineering and secrets management for SaaS Vault AWS Secrets Manager Doppler.

Common mistakes teams make

1. Encryption at rest not enabled on all storage.
2. Older TLS versions still accepted.
3. Internal traffic unencrypted.
4. Keys in the same account as the data.
5. No audit on key use.
6. Backups in the same account as the primary.
7. No documentation. Questionnaire answers are slow.
8. Treating encryption as the security program rather than as a starting point.

A one week audit and fix

1. Day one. Inventory storage locations. Verify encryption.
2. Day two. Inventory endpoints. Verify TLS versions.
3. Day three. Verify internal traffic encryption.
4. Day four. Verify key management is separate with audit.
5. Day five. Verify backups are encrypted and cross account.
6. Days six and seven. Document the posture for the customer questionnaire.

For more on the related work, read customer managed encryption keys enterprise engineering and the customer security questionnaire a strategic asset. On the broader compliance side, SOC 2 Type I vs Type II is the natural next read.