{"head":{"title":"What Is Encryption in Transit? Definition and Example","description":"Encryption in transit protects data moving between systems, usually with TLS, so it cannot be read or changed on the way. What it covers, mistakes.","canonical":"https://oceanlab.in/glossary/encryption-in-transit"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"encryption in transit","path":"/glossary/encryption-in-transit"}],"slug":"encryption-in-transit","term":"Encryption in transit","aka":["transport encryption","TLS"],"category":"Compliance","short":"Encrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way.","body":[["Encryption in transit protects data on the network: between a browser and your server, between your services, and between your system and third-party APIs. The standard way to do it is TLS. Version 1.3 is defined in RFC 8446, and NIST SP 800-52 Rev. 2 sets out how US government systems should select and configure TLS."],["The HIPAA Security Rule includes transmission security for ",{"href":"/glossary/ephi","text":"ePHI"}," in 45 CFR 164.312(e), and GDPR Article 32 names encryption among appropriate security measures."]],"why":["Unencrypted traffic can be read or changed by anyone on the path: public Wi-Fi, a compromised router, a misconfigured internal network. Encrypting every connection, not just the public website, is now a baseline that customers, auditors and browsers expect."],"example":["A clinic portal uses HTTPS for its website, but its app servers talk to the database and to a document service over plain connections inside the cloud network. A security review flags it, and the team turns on TLS for those internal links and the webhooks to its billing provider."],"inBuild":["Encryption in transit is set in the hosting and service configuration during a build: HTTPS everywhere, TLS to databases and internal services, and checks that third-party callbacks use it too."],"mistakes":[["Encrypting only public traffic and trusting the internal network."],["Leaving old TLS versions or weak settings switched on for compatibility."],["Turning off certificate checks in code to fix a test error, then shipping it."]],"related":[{"href":"/glossary/encryption-at-rest","label":"Encryption at rest","detail":"Encrypting stored data, such as databases, files and backups, so it cannot be read without the key."},{"href":"/glossary/tokenization","label":"Tokenization (payments)","detail":"Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service."},{"href":"/glossary/ephi","label":"ePHI (electronic protected health information)","detail":"Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects."},{"href":"/glossary/strong-customer-authentication","label":"Strong customer authentication (SCA)","detail":"The EU rule under PSD2 that online payments and account access must be confirmed with two independent factors from different categories."}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/compliance/pci-dss","label":"PCI DSS guide","detail":"Card data rules and how to shrink your scope."},{"href":"/compliance/soc-2","label":"SOC 2 guide","detail":"The controls behind a SOC 2 report."}],"sources":[{"title":"RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3","url":"https://www.rfc-editor.org/rfc/rfc8446","checkedAt":"2026-10-25"},{"title":"NIST SP 800-52 Rev. 2, Guidelines for TLS implementations","url":"https://csrc.nist.gov/pubs/sp/800/52/r2/final","checkedAt":"2026-10-25"},{"title":"45 CFR 164.312, HIPAA technical safeguards (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312","checkedAt":"2026-10-25"},{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}