--- title: "Is sensitive data encrypted in transit?" url: https://insuranceposture.com/questions/data-handling/sensitive-data-encrypted-transit category: "Data handling and policy" canonical_key: q_dat_005 evidence_state: verified updated: 2026-08-24 --- # Is sensitive data encrypted in transit? URL: https://insuranceposture.com/questions/data-handling/sensitive-data-encrypted-transit Section: Data handling and policy Evidence state: Verifiable from your tenant Nearly always yes for public traffic. The interesting parts are internal traffic, legacy protocol support, and the certificate nobody is watching. ## What the carrier is actually asking The carrier is asking whether sensitive data is protected while moving: to and from your public services, between your systems, and to third parties. Modern platforms default to encrypted transport, so the meaningful part of the answer concerns the exceptions. ## Why it is underwritten Interception matters less than it once did on public networks and matters considerably inside compromised environments, where attackers position themselves to capture credentials and data in motion. Encryption in transit also affects notification analysis, since data intercepted in clear text is more clearly disclosed than data captured in an encrypted stream. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is one of the most directly measurable questions on the application, and several of the settings are visible from outside as well as inside. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Azure | Minimum TLS version on storage accounts, key vaults, and databases | TLS 1.2 or higher enforced everywhere rather than left at a permissive default | | Azure | HTTPS redirect and TLS version on web applications and gateways | HTTP redirected to HTTPS, and the current TLS version in use on public endpoints | | Azure | Secure transfer required on storage accounts | Enabled, since without it a storage account accepts unencrypted requests | | Microsoft 365 | Mail transport security and any opportunistic TLS configuration | Encrypted transport to partners, with enforced TLS for those handling regulated data | | Certificates | Certificate expiry monitoring for public endpoints | Expiry alerting, since an expired certificate is the most common way transport security fails visibly | **Internal traffic is where the exceptions live** Public endpoints are almost always encrypted because browsers demand it. Internal service-to-service calls, database connections, and management traffic frequently are not, and that is the traffic an attacker inside the network is positioned to read. ## What a defensible yes requires - A minimum TLS version is enforced across services rather than left at platform defaults. - Unencrypted transport is refused rather than merely discouraged. - Internal service and database connections are encrypted, not only public traffic. - Mail to partners handling regulated data uses enforced rather than opportunistic encryption. - Certificates are inventoried with expiry alerting. ## How this answer goes wrong The public website scores well and a legacy internal application still speaks unencrypted to its database, or a storage account accepts unencrypted requests because secure transfer was never required. Both are quiet, both are measurable, and neither shows up in an external scan. ## If this answer turns out to be wrong What regulated data you hold sets which covers respond, so an inaccurate answer here narrows the policy quietly rather than loudly. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is TLS 1.2 still acceptable? Yes, as a minimum. Older versions should be disabled entirely, and 1.3 where supported. The important part is that a minimum is enforced rather than assumed. ### Does this include email? Mail uses opportunistic encryption by default, which can fall back to clear text. For partners handling regulated data, enforced TLS on a connector is the stronger position. ### What about internal traffic on a private network? It counts. Assuming the internal network is trusted is exactly the assumption that lateral movement exploits. ### How is this verified? Platform settings for the services you run, and an external scan for public endpoints. Both are quick and produce concrete evidence. ## Related questions - [Is data encrypted at rest on endpoints (laptops, desktops, portable devices)?](https://insuranceposture.com/questions/endpoint-and-patching/data-encrypted-at-rest-endpoints) - [Are backups encrypted?](https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted) - [Does the Applicant employ Data Loss Prevention (DLP)?](https://insuranceposture.com/questions/data-handling/applicant-employ-data-loss-prevention) - [Is IP filtering used to prevent connections from known-malicious addresses?](https://insuranceposture.com/questions/network-and-logging/ip-filtering-prevent-connections-from-known-malicious-addresses) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.