Encryption at rest and in transit

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · Compliance

Encryption is the control everyone claims and few fully cover. The gaps are always the same: a backup, an internal hop, a key in a config file.

In transit

Every connection carrying sensitive data should use modern TLS: your public endpoints, service-to-service traffic where feasible, and especially admin access. No weak ciphers, HSTS on web properties. This is the easiest thing for a customer or auditor to verify externally, so get it complete.

At rest

Encrypt where data sits: database, disk volumes, object storage — and, critically, the backups and snapshots, which teams forget. On the major clouds this is often a per-resource setting; the work is confirming it is on everywhere, not just the primary datastore.

Key management is the real test

Ciphertext is only as safe as the key. Auditors and serious buyers look at where keys live (a managed KMS/HSM, not source control or a config file), who can access them, and how they rotate. A strong algorithm with a key checked into a repo is not encryption — it is obfuscation.

Evidence

The proof is configuration: a TLS scan, the storage-encryption flags on your resources, and the KMS access + rotation policy. Track these as controls so they are not a console-screenshot scramble before an audit. SentinelPanda links the encryption controls to that evidence.