What is a Data Encryption?

Encryption is generally split into two states that need separate handling: at rest (data stored in a database or file system) and in transit (data moving over a network, typically protected by TLS). Modern at-rest encryption commonly uses AES-256-GCM, an authenticated cipher that also detects tampering, not just confidentiality loss. Key management is where most real-world encryption schemes actually fail, not the cipher itself. Keys need to be stored separately from the data they protect, rotated periodically, and rotation needs a backward-compatible overlap window so data encrypted under an old key can still be decrypted while new data uses the new one - a hard cutover that can't decrypt old records is a self-inflicted outage. Encryption alone doesn't satisfy every compliance requirement; frameworks like SOC 2 and HIPAA also expect access controls, audit logging, and key rotation discipline layered on top of the raw cryptography.