Encryption in transit
Also called transport encryption, TLS.
Encrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way.
Last updated
What it is.
Encryption in transit protects data on the network: between a browser and your server, between your services, and between your system and third-party APIs. The standard way to do it is TLS. Version 1.3 is defined in RFC 8446, and NIST SP 800-52 Rev. 2 sets out how US government systems should select and configure TLS.
The HIPAA Security Rule includes transmission security for ePHI in 45 CFR 164.312(e), and GDPR Article 32 names encryption among appropriate security measures.
Why it matters
Unencrypted traffic can be read or changed by anyone on the path: public Wi-Fi, a compromised router, a misconfigured internal network. Encrypting every connection, not just the public website, is now a baseline that customers, auditors and browsers expect.
In a product build
Encryption in transit is set in the hosting and service configuration during a build: HTTPS everywhere, TLS to databases and internal services, and checks that third-party callbacks use it too.
Common mistakes.
- 01
Encrypting only public traffic and trusting the internal network.
- 02
Leaving old TLS versions or weak settings switched on for compatibility.
- 03
Turning off certificate checks in code to fix a test error, then shipping it.
Read the official text.
Primary sources this definition is based on.
- RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3checked 2026-10-25
- NIST SP 800-52 Rev. 2, Guidelines for TLS implementationschecked 2026-10-25
- 45 CFR 164.312, HIPAA technical safeguards (eCFR)checked 2026-10-25
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
Work it out with a tool.
Related terms.
- Encryption at restEncrypting stored data, such as databases, files and backups, so it cannot be read without the key.
- Tokenization (payments)Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service.
- ePHI (electronic protected health information)Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects.
- Strong customer authentication (SCA)The EU rule under PSD2 that online payments and account access must be confirmed with two independent factors from different categories.
Guides and pages
Browse the full glossary or read answers to common questions.
