Answer encryption questions by naming where data is encrypted, with what class of mechanism, and who controls the keys. Cover transit, storage, backups and key management separately. "Everything is encrypted" is the sentence that fails review, because someone will ask about the one place it is not.
Why precision matters
GDPR Article 32 lists encryption and pseudonymisation among measures a controller or processor should consider, at a level of security appropriate to the risk. The same article lists resilience, prompt restoration of access and regular testing of measures. Buyers draw their questions from lists like this, so mirror the structure in your answers.
Break the question into parts
In transit. Which connections: browser to service, service to service, service to database, to third parties? State the protocol family, such as TLS, and the minimum version you allow if you know it.
At rest. Databases, object storage, disks, laptops, backups. State which are encrypted by the platform and which by your application. Note any store that is not.
Backups. Are they encrypted, where are they kept, who can restore them?
Key management. Who holds keys, how they are rotated, who can access them, whether a managed key service is used, and whether customers can supply their own keys, which you should say only if the product supports it.
Sample answer
"Data in transit between customers and our service uses TLS. Internal service to service traffic is encrypted. Customer data at rest in our primary database and object storage is encrypted using keys held in a managed key service, with access limited to named roles. Backups are encrypted with the same mechanism. Employee laptops use full disk encryption enforced by device management."
Each sentence is something you can check. Adjust it to your real setup.
Gaps to name
If an internal log store is unencrypted, or a legacy system uses older protocols, answer Partial and describe the plan. See how to choose Yes, No or Partial.
Avoid these phrases
- "Military grade". It means nothing specific.
- "Unbreakable". Not a claim you can support.
- "End to end encrypted". It has a precise meaning. Use it only if the provider cannot read the data.
Keep proof handy
Screenshots of storage settings, a configuration export or a policy page serve as evidence. Date them.
Sources
Quick check
Is disk encryption enough for data at rest?
It protects against lost media, but not against access through a compromised application. Describe access controls as well.
Do we need to name the algorithm?
Often a reviewer is satisfied with the protocol family and key management description. Name specifics if asked and if you are sure of them.
Last reviewed: 19 October 2026.
