How to answer
Is customer data encrypted in transit?
Easy to answer yes to and easy to check from the outside, which makes it one of the few questions where a wrong answer is found rather than believed.
Yes. All data in transit is protected with TLS 1.2 or higher. This applies to traffic between customers and our service, and to traffic between our own services and our sub-processors.
FillTrust grades an answer like this confirmed in your documents when your documents support it.
- Answered from
- Your information security policy. The specific TLS version is usually in an architecture or engineering standard rather than the policy itself.
- Evidence to attach
- Nothing, normally. An SSL Labs report is occasionally requested and is free to produce.
- Where it is asked
- CAIQ v4.0 · CEK-03SIG LiteISO 27001 Annex A · A.8.24
This is the most externally verifiable claim on the whole questionnaire. Anyone can point a TLS scanner at your domain and see your minimum version, your cipher suites and your certificate chain in under a minute. If your answer and your endpoint disagree, the reviewer will find out, and they will wonder what else was answered from memory.
So answer it from the load balancer configuration rather than from what you assume. If your policy says TLS 1.2 minimum, check that the zone or the load balancer actually enforces a 1.2 floor. A surprising number of teams have the policy and not the setting, because the default when the infrastructure was created was lower and nobody revisited it.
The part most answers miss is everything that is not the public edge. The question is about data in transit, not about your website. Traffic between your own services, connections to your database, deliveries to a webhook endpoint, files dropped on an SFTP server, and calls to every sub-processor are all in scope. Inside a single cloud VPC this is usually fine and usually encrypted, but "usually" is doing work in that sentence. A plaintext internal hop is the kind of thing that exists for two years because nobody asked.
A reviewer who sees "TLS 1.2 or higher, including between our own services and our sub-processors" reads a team that has thought about the whole path. A reviewer who sees "yes, we use HTTPS" reads a team that has thought about the website.
How this one goes wrong
Specific to this question, not general advice.
- Answering only for the public edge. The question covers internal service-to-service traffic and traffic to your sub-processors, and those are where unencrypted hops actually survive.
- Naming a minimum TLS version your load balancer does not enforce. This one is checkable from outside in about thirty seconds, so a wrong answer is found rather than believed.
- Forgetting non-HTTP paths: database connections, message queues, SFTP drops, webhook deliveries.