Encryption at Rest vs. In Transit: What Each One Actually Protects
September 16, 2026 · 3 min read
"We encrypt our data" is one of the most common and most incomplete claims in small-office security. Encryption is not one thing. It protects data differently depending on where the data is at that moment, and a gap in either place can undo the other.
Encryption in transit
This protects data while it moves: between a browser and a website, between your computer and a cloud service, or between two systems on a network. The padlock and "https" in your browser are the everyday example. It stops someone who can see the traffic, say on a shared Wi-Fi network, from reading it. It does nothing once the data has arrived and is sitting somewhere.
Ways it shows up in a small office: secure web portals for clients, encrypted email or a secure file-sharing link, and the connection between your computer and your cloud storage. MyVaultMate sends its reports over TLS, which is encryption in transit.
Encryption at rest
This protects data while it is stored: on a laptop's drive, in a database, in cloud storage or on a USB stick. For Windows computers, the common form is BitLocker full-disk encryption; for Linux, disk encryption is set up through the system's own tools, so ask your IT provider. If the device is lost or stolen, the contents are unreadable without the key. MyVaultMate's database and backups are stored encrypted on US-based hosting, which is encryption at rest on our side.
Why you need both
A file sent over an encrypted connection but saved unencrypted onto a laptop is protected in transit and completely exposed at rest, which matters the moment that laptop is lost. The reverse gap exists too: an encrypted disk does not protect a file the moment it is attached to an email and sent as a plain attachment, or shared with a link that anyone can open. The FTC Safeguards Rule, for firms it covers, includes encryption of customer information as an expected safeguard; check the current text at https://www.ftc.gov.
| In transit | At rest | |
|---|---|---|
| Protects | Data moving over a network | Data stored on a device or server |
| Typical tool | HTTPS, TLS, secure file-sharing | BitLocker, encrypted databases |
| Fails when | Data lands somewhere unprotected | Data leaves the device in the clear |
| Helps most if | Someone is watching the network | A device is lost or stolen |
What neither one covers
- Access by the logged-in user. While a computer is running and unlocked, disk encryption does not stop malware or a thief from reading the files.
- Weak passwords and no multi-factor authentication. A stolen password opens the encrypted data like a key.
- Copies you forgot. Encryption protects the data you have protected. It does nothing for the spreadsheet in a personal Downloads folder on an unencrypted computer, or on a USB drive.
Where discovery still matters
That last point is a discovery problem, not an encryption problem. MyVaultMate does not encrypt anything. What it does is find files with Social Security numbers, ITINs, payment card numbers, labeled identification values, health ID numbers and health-related keywords across local drives, synced folders and external disks, so you know which files exist and where. Your IT provider can then move them somewhere protected, encrypt them or remove them. Detection is rule-based, so review findings before acting, and some file types are not scanned yet.
A short checklist for this week
- Confirm that BitLocker or equivalent disk encryption is on for every laptop.
- Check that your email and file-sharing tools use encrypted connections, and stop sending sensitive files as plain attachments.
- Turn on multi-factor authentication where available.
- Find out where unencrypted sensitive files already live.
This is general education rather than legal or IT advice. You can see what a report looks like at /sample, or read how it works at /how-it-works/.