Encryption at Rest vs in Transit: What Each One Actually Protects

"Is our data encrypted" is a question that has two genuinely different correct answers depending on what's actually being asked, and conflating them is one of the more common gaps we find in a security review — a site with solid HTTPS and an unencrypted database, assuming one covers the other.

What each type actually protects against

Encryption in transit — HTTPS — protects data moving between a user's browser and your server, stopping anyone intercepting that connection from reading it. Encryption at rest protects data sitting in your database or storage, stopping anyone who gains unauthorized access to the storage itself from reading it directly. Neither one protects against the other's specific risk.

Where the gap usually shows up

• A site with a valid HTTPS certificate and a completely unencrypted production database, leaving stored data exposed if the database itself is ever compromised.
• Backups stored without the same encryption standard as the live database, quietly becoming the weaker link in an otherwise solid setup.
• Sensitive fields — passwords, payment details, personal identifiers — stored in plain text when they should specifically be hashed or encrypted at the field level, beyond whatever general database encryption is in place.
• Data in transit between internal services, not just the public-facing connection, left unencrypted because it's "internal" and assumed safe.

Why this matters even for a small business

This is the same category of foundational hygiene as the general security basics most small sites skip, and it directly supports the privacy commitments most modern privacy policies actually promise.

HTTPS protects data on its way to you. Encryption at rest protects it once it's arrived. A complete security posture needs both, and most audits find only one.

This is a straightforward, one-time configuration for most modern hosting platforms — the cost of setting it up correctly is genuinely small relative to what it protects.