Two States of Data

Data exists in two primary states: at rest (stored) and in transit (moving). Each state faces different threats and requires different protection.

Data at rest is stored on hard drives, SSDs, cloud servers, or databases. Threats include physical theft, unauthorized server access, database breaches, and insider threats.

Data in transit is being sent between devices over networks. Threats include man-in-the-middle attacks, packet sniffing, Wi-Fi eavesdropping, and ISP surveillance.

Comprehensive data protection requires encryption in both states. A service that encrypts data in transit (HTTPS) but stores it unencrypted at rest is only half-protected. Similarly, encrypted storage is meaningless if data travels unencrypted over the network.

How Each Works

Encryption in Transit (TLS/HTTPS): Transport Layer Security (TLS) encrypts the connection between your browser and the server. When you see the padlock icon in your browser, TLS is active. Your data is encrypted during transmission, preventing eavesdropping. However, the server decrypts the data upon receipt — it only protects the communication channel, not the data itself.

Encryption at Rest: Data is encrypted on the storage medium using algorithms like AES-256. Even if an attacker gains physical access to the server or database, the data is unreadable without the decryption key. However, if the service holds the key (server-side encryption), they can decrypt it.

Client-Side Encryption (both states): Services like ZeroLatch can encrypt file contents before transmission. Data is also protected in transit, while recovery depends on the selected mode. This reduces plaintext exposure but does not establish that one implementation is the most comprehensive protection for every threat model.

What to Look for in a Service

When evaluating any service that handles sensitive data:

✅ HTTPS/TLS — minimum requirement, encrypts data in transit ✅ Encryption at rest — protects stored data from server breaches ✅ Client-side encryption — the gold standard, protects both states with keys you control ✅ Forward secrecy — past sessions remain secure even if current keys are compromised

❌ HTTP only — data travels in plain text, visible to anyone on the network ❌ No at-rest encryption — stored data is vulnerable to database breaches ❌ Server-side keys only — provider can decrypt your data (and be compelled to do so)

ZeroLatch implements all three layers: TLS for transit, AES-256-GCM for storage, and client-side encryption so that files are encrypted before upload and recovery depends on the selected mode.