Encryption controls for SOC 2

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · SOC 2

SOC 2 is principles-based, so there is no "use AES-256" rule — but a report without TLS everywhere and encryption at rest will draw questions fast.

In transit

Every connection that carries customer or sensitive data should use TLS — public endpoints, internal service-to-service traffic where feasible, and admin access. Modern TLS, no weak ciphers, HSTS on web properties. This is table stakes and the easiest thing for an auditor (or a customer security review) to check from the outside.

At rest

Encrypt the places data sits: database, disk volumes, object storage, backups. On major cloud platforms this is often a single setting per resource — the work is confirming it is on everywhere, including the backups and the snapshots, not just the primary store.

Key management is the real test

Encryption is only as good as the keys. Auditors look at where keys live (ideally a managed KMS or HSM, not in code or config), who can access them, and how they rotate. Hard-coded keys in a repo or a shared secret nobody rotates undermines the whole control regardless of the algorithm.

Evidence

The evidence is configuration, not prose: TLS scan results, the storage-encryption flags on your resources, and the KMS policy showing access control and rotation. SentinelPanda tracks the encryption controls and links them to that configuration evidence so a control owner is not screenshotting consoles the week of the audit.