Encryption at rest and in transit for web hosting, explained

Encryption in transit scrambles data while it moves between two machines, usually with TLS, the protocol behind HTTPS. Encryption at rest scrambles data while it sits on a disk, in a database file, a backup or a snapshot. A hosting platform needs both, and the useful questions are which hops and which copies each one covers, and who holds the keys.

The two kinds side by side

Encryption in transit: count the hops

A request to a hosted app crosses several connections, each encrypted or not on its own.

1. Browser to edge. This is the padlock in the address bar. Vercel, for example, serves every deployment over HTTPS, lists only TLS 1.2 and 1.3 ciphers, and answers plain HTTP with a 308 redirect that can't be disabled. Let's Encrypt, which most platforms use for free certificates, issues certificates valid for 90 days by default, so renewal has to be automatic.
2. Edge to your app. A CDN or proxy decrypts the request, then opens a new connection to your server. Cloudflare's Flexible mode is the clearest example of what can go wrong: visitors get HTTPS to Cloudflare, but Cloudflare reaches your origin over plain HTTP. Its own docs call the result partially secure and tell you to use Full or Full (strict) when the app handles logins or personal data.
3. App to database. PostgreSQL's client library defaults to sslmode=prefer, which encrypts only if the server offers it and doesn't check the certificate. The PostgreSQL docs say that default makes no sense from a security point of view. Use verify-full when your database lives on another network.
4. Inside the provider's network. Traffic between services, replicas and backups. Clever Cloud says each peer on its network is identified, authenticated and talks in encrypted form, so an intruder on the network can't read the traffic.

HSTS closes one more gap on the first hop. The Strict-Transport-Security header tells browsers to use only HTTPS for your domain from then on and to refuse to click through certificate errors, so a visitor can't be downgraded to HTTP on a hostile network.

Encryption at rest: count the copies

Disk encryption protects against physical loss, such as a drive pulled from a rack or a backup copied to the wrong place. It doesn't hide data from anyone reading through the running database, because the system decrypts it for them. At-rest encryption comes in three common layers.

• Volume or disk encryption. The provider or you encrypt the whole block device. OVHcloud Block Storage, for instance, lists server-side encryption for its volumes. On a rented server you can encrypt partitions yourself; Hetzner's server FAQ notes that a file system on its virtual disks can be encrypted.
• Database encryption. The managed database service encrypts its storage. AWS says encrypted RDS instances cover the underlying storage, logs, automated backups, read replicas and snapshots, all with AES-256. Scalingo lists encryption at rest and TLS connections on its PostgreSQL plans, and Scaleway's Managed Database includes encryption at rest.
• Application-level encryption. Your code encrypts a field, such as an API token or a health record, before it reaches the database, and keeps the key elsewhere. Only this layer protects the value from someone who can query the database.

Who holds the keys

Encryption moves the risk to the key. Three setups are common.

Losing a key is a real outage. AWS says you can't change the KMS key of an encrypted RDS instance after you create it, and an instance that loses access to its key stops; if the key isn't back within seven days, the instance can only be restored from a snapshot or backup. Customer-managed encryption keys compares the key services of European clouds.

Keys also matter for sovereignty. If the provider manages the keys, it can decrypt on its own systems, so encryption alone doesn't settle which government could order access. The company running the service and the law it answers to still count; EU region vs EU company covers that side.

What the GDPR says about it

Article 32 of the GDPR names pseudonymisation and encryption among the measures controllers and processors should apply when they fit the risk. It isn't compulsory in every case, but skipping it needs a reason.

Encryption also changes what a breach costs you. Under Article 34, you don't have to tell affected people about a high-risk breach if the data was protected by measures that make it unintelligible to anyone without access, and encryption is the example the law gives. That only helps if the key wasn't stolen with the data. For the rest of the hosting duties, see the GDPR hosting checklist.

What providers publish

Platform	Layer	What its own page says
Eurobase	Secrets and tokens	Variable values and linked repository tokens are stored encrypted
Vercel	Browser to edge	HTTPS on every deployment, TLS 1.2 and 1.3, forced redirect from HTTP
Cloudflare	Edge to origin	Flexible mode leaves the origin hop unencrypted; Full or Full (strict) encrypts it
Clever Cloud	Internal network	Peers communicate in encrypted form
Scalingo	Database	PostgreSQL with TLS connections and encryption at rest
Scaleway	Database	Managed Database with encryption at rest
OVHcloud	Block storage	Server-side encryption for volumes
AWS	Database	RDS encryption covers storage, logs, backups, replicas and snapshots

Details are from each provider's own page, checked on 9 and 10 November 2026.

Questions to ask a host

• Which hops are encrypted? Browser to edge, edge to app, app to database, and replication between machines. Ask for each one, not a general yes.
• Which copies are encrypted at rest? Live data, backups, snapshots, logs and build artifacts can each be handled differently.
• Who manages the keys, and can you bring your own? Find out what happens to your data if a key is lost or deleted.
• Which TLS versions are accepted? Ask for the oldest one still allowed.
• Is it in the contract? Encryption claims belong in the technical and organisational measures of the DPA, not only on a marketing page. The DPA checklist shows what to look for.

How Eurobase handles it

Eurobase is a hosting platform from a business registered in Warsaw, Poland, and it serves apps from European infrastructure run by Scaleway, a French provider. Its own pages state:

• Every environment variable value is stored encrypted, and a value marked secret can't be read back after you save it. See environment variables and secrets.
• The read-only access token you give to link a GitLab, Forgejo or Gitea repository is stored encrypted.
• Custom domains get Let's Encrypt certificates through a DNS challenge, so the certificate exists before your traffic record changes, and plain HTTP requests are redirected to HTTPS. Custom domains and HTTPS walks through it.

What's missing: Eurobase doesn't publish its accepted TLS versions or a statement on disk encryption for files, logs and the SQLite databases it offers for Workers, and it doesn't document customer-managed keys. It also has no managed Postgres, so database encryption is a question for the database provider you choose. It doesn't hold ISO 27001 or SOC 2 yet; both are in progress. If your project needs written answers on these points, ask before you move personal data. The DPA and subprocessor list show who handles the data.

Frequently asked questions

Is HTTPS enough to protect my users' data?

No. HTTPS covers the connection from the visitor to the server that ends TLS. Behind it, data crosses other hops and lands on disks and in backups, so those need encryption too, plus access control on the running system.

Does encryption at rest protect against a hacked app?

Mostly not. An attacker with valid access to your app or database gets decrypted data like any other user. To protect specific fields from someone who can query the database, encrypt them in your code with a key kept elsewhere.

Do I have to encrypt personal data under the GDPR?

The GDPR names encryption as an example of an appropriate measure in Article 32, not a fixed rule for every system. In practice, a host without encryption in transit and at rest is hard to defend after a breach. Encrypted data with a key the attacker didn't get is also one of the conditions under Article 34 that spare you from telling affected people.

Does encryption keep data away from US authorities?

Only if the keys are out of reach. When a provider manages the keys, it can decrypt on its systems. The company running the service and where the keys live decide it; data residency vs data sovereignty explains the difference.

Sources

• GDPR Article 32 and GDPR Article 34
• Vercel: Encryption and TLS
• Cloudflare: Flexible encryption mode and Cloudflare: encryption modes
• Let's Encrypt FAQ
• MDN: Strict-Transport-Security
• PostgreSQL: SSL support in libpq and PostgreSQL: secure TCP/IP connections with SSL
• AWS: Encrypting Amazon RDS resources
• Clever Cloud security
• Scalingo PostgreSQL
• Scaleway Managed Databases documentation
• OVHcloud Block Storage
• Hetzner Cloud server FAQ
• Eurobase getting started, Eurobase about, Eurobase privacy notice, Eurobase DPA and Eurobase subprocessors