"Is my data encrypted" is a question I hear as if it has a single yes-or-no answer. It's actually two separate questions, protecting against two genuinely different risks, and a lot of apps have a solid answer to one while never having actually addressed the other.
Encryption in transit
This protects data while it's traveling, between a user's browser and your server, or between your server and a database. It's what HTTPS provides by default on essentially every modern app, scrambling data so that anyone intercepting the connection along the way, on public wifi, on a compromised network, sees only unreadable noise rather than the actual contents being sent.
Encryption at rest
This protects data while it's sitting still, stored in your database or on a disk somewhere, not moving anywhere at all. It guards against a completely different scenario: someone gaining direct access to the storage itself, a stolen backup, a misconfigured storage bucket, unauthorized access to the underlying disk, rather than intercepting a connection in transit.
Why having only one leaves a real gap
An app with excellent encryption in transit but none at rest is fully protected against someone intercepting network traffic, and completely unprotected if someone gains direct access to the stored data itself, whether through a misconfigured backup, an exposed storage bucket, or a compromised server. The reverse is also true: strong encryption at rest doesn't protect a connection an attacker intercepts while data is actively being sent.
What this means practically
- In transit is largely handled for you by default through HTTPS on any reasonably modern hosting setup, worth confirming rather than assuming, but usually already in place.
- At rest is more often something you need to actively configure or confirm with your database or storage provider, rather than something that's automatically on everywhere by default.
- Both matter for the same reason: they close off two genuinely different ways the same sensitive data could end up in the wrong hands.
"Is it encrypted" is worth turning into two separate, specific questions, in transit and at rest, and confirming both rather than assuming one covers the other.