Every vendor claims their data is encrypted, and buyers nod along. But it is worth understanding what encryption actually protects, because visitor data — names, photos, verified identity — is exactly the kind of personal data that must not leak. Two phrases do most of the work: in transit and at rest.
Encryption in transit (TLS)
TLS (the successor to SSL) protects data as it moves across networks — between a kiosk, a browser and the server. It stops someone intercepting the connection from reading or tampering with the data in flight. It is why a padlock appears in the browser bar.
Encryption at rest (AES-256)
AES-256 is a strong, widely used standard for encrypting stored data — the records sitting in a database or a backup. If someone got hold of the underlying storage, encryption at rest keeps the contents unreadable without the keys.
Why both are needed
In transit protects the journey; at rest protects the destination. You need both, plus sensible key management and access controls, or you have only locked one door. Encryption is necessary but not sufficient — it sits alongside role-based access and retention limits.
Where it fits with DPDP
The DPDP Act expects reasonable security safeguards for personal data; encryption in transit and at rest is a core part of that — see the DPDP Act and visitor data.
Certopact's posture
Certopact encrypts visitor data in transit (TLS) and at rest (AES-256), with role-based access and India data residency. Confirm current specifics with the team as part of your security review.