Data encryption in transit and at rest: a practical guide

Encryption sounds like a compliance checkbox, but poorly implemented it creates false confidence: readable data in logs, keys on the same server as files, or obsolete TLS a proxy can intercept. This guide separates in transit (moving data) and at rest (stored data) with concrete actions for product and ops teams.

Encryption in transit: TLS done right

All traffic between browser and API, between microservices, and to remote databases must use TLS 1.2+ (ideally 1.3). Disable weak protocols and ciphers. Renew certificates with automatic alerts 30 days ahead.

• HSTS on public domains to prevent HTTP downgrade.
• Certificate pinning only if you understand rotation operational cost.
• mTLS between critical internal services when traffic crosses shared networks.
• Verify third-party APIs (payments, SMS) also use valid TLS.

Encryption at rest: what to encrypt first

Not everything needs the same level. Prioritize: credentials, tokens, payment data, government identifiers, medical or financial histories, and backups. Generic marketing fields can wait for a later encryption sprint.

1. Volume/disk encryption on servers and laptops.
2. Database encryption (column-level) for sensitive fields.
3. Object encryption in S3/Azure Blob with least-privilege access policies.
4. Backup encryption before sending offsite.

Encrypting the disk but leaving the key in a .env on GitHub is not encryption—it is theater.

Key management (KMS)

Use a managed KMS or HSM (AWS KMS, Azure Key Vault, Google Cloud KMS) instead of hardcoded keys. Define annual rotation or rotation on incident, environment separation (dev/staging/prod never share master keys), and audit of who decrypted what.

Common mistakes in Mexican software

• Logs printing full payloads with personal data.
• Homemade symmetric encryption instead of standard libraries (AES-GCM).
• Exposing sequential IDs without authorization layer even when transport is TLS.
• Forgetting to encrypt queues (SQS, Rabbit) carrying PII between services.

Encryption and LFPDPPP

The law does not mandate a specific algorithm, but requires technical measures proportional to risk. Demonstrating encryption in transit and at rest for sensitive data, plus access control, is baseline in audits. Document decisions: what you encrypt, with what, who administers keys.

Implementation checklist

Week 1: inventory of sensitive data and flows. Week 2: TLS and secrets out of code. Weeks 3–4: at-rest encryption in DB and backups. Month 2: log review and test restore of encrypted data.

Encryption in mobile apps

If your team uses custom field apps, validate encrypted local storage (Keychain/Keystore), never store tokens in plain AsyncStorage, and force re-authentication after idle time. Stolen phones are a common vector in Mexican sales and logistics.

Rotation and key lifecycle

Define events triggering immediate rotation: offboarding someone with vault access, suspected repo leak, end of contract with a vendor holding an API key. Automate rotation where the vendor allows (KMS, managed DB secrets). Document dependencies: which service breaks if you rotate today.

Building or maintaining software with Mexican customer data? At Devson Labs we design secure architecture and review encryption implementations on production systems. Schedule a consultation or start with a stack Radiography.