Is customer data encrypted in transit and at rest?
A data question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. Customer data is encrypted in transit with TLS [1.2 or higher] and at rest with [AES-256] using [our cloud provider's managed keys], including in backups.
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- Your cloud provider's encryption settings for the databases and storage buckets involved
- A TLS test report for your public endpoints
If you don't do this yet
Most managed databases and storage services encrypt at rest by default. Check the setting for each one before answering, and state exactly what's covered rather than a general yes.
Related questions
How long do you keep customer data, and how is it deleted?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.