Encryption is primarily used to safeguard the contents of a message so that only the intended recipient could read it. This is done by replacing the contents with unrecognizable data, which could be understood only by the intended recipient. This is how encryption became a method to protect data from those who might want to steal it.
Encryption can be used in two situations.
- Encryption in Transit
- Encryption at Rest (EAR)
Encryption in Transit
Refers to data that is encrypted when it is in transit — including from your browser to the web server and other third parties via integrations.
Encrypting data in transit protects your data from man-in-the-middle-attacks.
Encryption at Rest
Refers to data that is encrypted when it is stored (not moving) — either on a disc, in a database, or some other form of media. In addition to encryption of data during transit, encryption of data when it is stored in the servers provides an even higher level of security. EAR protects against any possible data leak due to server compromise or unauthorized access.
While encryption in transit is done during the transport layer, EAR is done at the application layer using the AES-256 algorithm. This is a symmetric encryption algorithm that uses 128-bit blocks and 256-bit keys. The key used to convert the data from plain text to cipher text is called the Data Encryption Key (DEK). The DEK is further encrypted using the Key Encryption Key (KEK), prov
iding yet another layer of security. The keys are generated and maintained by our in-house
Key Management Service (KMS).The following data is encrypted at rest:
- All file attachments and documents from the form fields marked as encrypted
- Data collected from the form fields marked as encypted
- Sensitive data like integration tokens and payment credentials
Full-disk encryption
Aside from application layer encryption,
full disk encryption is available for our IN, AU, EU, and JP data centers.