What is encryption at rest and in transit?
Encryption at rest and in transit is the practice of encrypting data both where it is stored and while it crosses a network, so a stolen drive or intercepted traffic is unreadable without the keys. Encryption at rest covers disks, databases, object storage, and backups, usually with the Advanced Encryption Standard (AES) and keys held in a key management service. Encryption in transit covers traffic between browsers, applications, and servers, using Transport Layer Security (TLS), the protocol behind HTTPS. Audit frameworks such as SOC 2 commonly expect both. Neither protects data while it is being processed in memory, which is the gap confidential computing addresses.
AI systems create new copies of sensitive data that are easy to overlook. A retrieval system keeps text chunks and embeddings in a vector database, and embeddings can sometimes be reversed to recover much of the original text. Prompt logs, conversation histories, fine-tuning datasets, and caches hold the same customer or patient details as the source systems and need the same protection.
Encryption at rest and in transit in practice
A county government deploys AI search over its permitting and code enforcement records. The source documents, the vector index, and the conversation logs sit on encrypted volumes, with keys in the county’s own key management service. Traffic uses TLS end to end, including connections between the application, the index, and the model server inside the county’s data center. When servers are retired, the county destroys their keys, leaving the old drives unreadable.