Security questionnaire answers › Data protection
Do you encrypt data in transit? How to answer it in a security questionnaire
Why buyers ask this
Reviewers need assurance that data cannot be read or altered on the network between users, services and third parties.
What a strong answer includes
- Specify the minimum TLS version (TLS 1.2 or higher) and that HTTP is redirected or blocked.
- Include internal service-to-service traffic, not only public endpoints.
- Mention how certificates are issued and renewed.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. All traffic to our applications and APIs uses TLS 1.2 or higher, and plain HTTP is redirected to HTTPS. Internal service traffic is encrypted using [TLS/mTLS/private networking]. Certificates are issued and renewed automatically through [provider].
Evidence to attach
- TLS scan report
- Load balancer or CDN TLS configuration
- Certificate management process
Common mistakes
- Forgetting internal traffic or email delivery.
- Claiming TLS 1.3 only when older versions are still enabled.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.