Encryption at rest and in transit
Scrambling data twice: once while it sits on disk, once while it crosses the network. A stolen drive or a sniffed connection gets noise.
See it
What it is
Two different jobs with one word. In transit means the data is scrambled while it moves: HTTPS/TLS between browser and server, TLS between your app and its database, encrypted connections to every third-party API. At rest means the data is scrambled while it sits: disk-level or column-level encryption on the database, the object store, the backups, and the log archives everyone forgets.
In practice both are mostly a config switch now. Force HTTPS with a redirect plus HSTS, keep TLS 1.2 as the floor and prefer 1.3, and turn on the AES-256 storage encryption your provider ships (RDS, Cloud SQL, S3, Supabase all have a box to tick). Keys live in a managed KMS or vault, never in the repo. Encrypt the backups too, because a backup is just your database with worse access control.
Gotcha: at-rest encryption only defends against someone walking off with the disk or the snapshot. Your app queries the database with valid credentials, so a leaked connection string or a SQL injection reads plaintext no matter how encrypted the volume is. If you need protection from yourself and your host, that is end-to-end or application-layer encryption, and it costs you search, sorting, and analytics.
Ask AI for it
Audit and fix encryption in this project for both states. In transit: force HTTPS with a 301 redirect, add a Strict-Transport-Security header with a one-year max-age and includeSubDomains, require TLS 1.2 minimum (prefer 1.3), and set sslmode=require (or verify-full) on every database and cache connection string. At rest: enable AES-256 storage encryption on the database, object storage, and automated backups, and add column-level encryption for any secret or token column. Move all keys into a managed KMS or secret store with rotation, and remove any key committed to the repo. Output a checklist of what was already on, what you changed, and what still needs a provider console click.