What to write when they ask if customer data is encrypted

What the row is asking

Reviewers ask "Is data encrypted at rest?", about encryption in transit, who manages the keys, and encryption-at-rest. The words differ. They want to know the data is protected on the disk and on the way, and who can open it.

"Is data encrypted at rest?" means the customer data in your service, on the disks where it sits. A Yes because the database or hosting vendor encrypts those disks is only half the row. Name that company, and say who holds the keys.

Encryption in transit is a different sentence. It is the connection between the customer and your service, and between your service and the companies that store the data. Do not answer the disk question with the connection, or the connection with the disk.

A data classification policy is a third question. It asks whether you have defined what must be encrypted. A page that mentions encryption is not that policy.

Where the data sits is a different row. The location line does not say the disks are encrypted. A model provider that receives customer data is a company on the vendor list. The list can name that company. It does not answer who manages the keys.

What reviewers accept

They accept a plain description of what is true. Name who encrypts the disks, and who manages the keys. If the hosting or database vendor encrypts the disks and holds the keys, say that. If you manage the keys, say that, and name who on your team can use them.

If you have no classification policy, answer No. Do not tick Yes because a policy, a privacy page, or a security page mentions the topic.

Laptops and other portable devices count only where the operating system enforces encryption. Backups count only when those copies are encrypted too. If you have not checked a device or a copy, say you have not checked it.

An honest No on its own is a complete answer. The answer that fails is a Yes the documents do not support, when they ask who encrypts and who holds the keys.

Write the sentence only when it is true. An encryption statement is a promise to this customer. If they ask to see the setting, show the screen from the company you named, or say you do not have it.

What not to write

Do not tick Yes because a policy merely mentions encryption. Mentioning the topic is not the control.

Do not answer Yes for a classification policy you do not have. If nothing defines what must be encrypted, the answer is No.

Do not stop after writing that the hosting vendor encrypts the disks. That is half the row. Name the company, and say who manages the keys.

Do not write an algorithm, a key length, or a TLS version you have not read on that company's page or in your own settings.

Do not say laptops, portable devices, or backups are encrypted unless you have checked those copies.

Do not paste an encryption statement you cannot stand behind. It becomes a promise to the customer.

Do not describe encryption-at-rest you have not turned on, or a key you do not hold, as if you run it yourself.

Where this answer lives

Keep the sentence in the questionnaire answer you control. The vendor list is a different page. It can name the company that hosts or encrypts the data, once you type that company.

Trust Prep does not store the algorithm, the TLS version, who holds the keys, or an encryption claim. It does not fill this row.

A company, a location, or an agreement link shows on the public page only after you save it. An encryption claim does not, because there is no field for it.

If you want the longer notes

The companies that host or encrypt the data belong on the vendor list. Why reviewers ask for that list is in the vendor list guide.

A table you can copy, with the columns the list already uses, is in the subprocessor list template. Encryption is not a column on that table.

The overview line that names encryption, among the other controls you actually run, is in the security questionnaire guide.

When a model provider sees customer data, whether that company belongs on the list is in the AI provider guide. The row names the company. It does not store who holds the keys.

Where the data sits is a different line from whether it is encrypted. What to write for location is in the processing location guide.