What is Data Encryption?

Data encryption is a way of encoding information to make it difficult for unauthorized persons to access it. This procedure protects the data from unauthorized access, manipulation, loss or destruction, whether the data is stored in servers, being transmitted via networks or being actively processed.

• Encryption at Rest: For data at rest, there are enhanced algorithm sets such as AES-256 to be used. This ensures that if the physical storage device is somehow breached, the data will remain inaccessible without the decryption key.
• Encryption in Transit: For data in transit, encryption methods such as Transport Layer Security (TLS) are used to establish a secure communication channel between your device and the cloud service. This eliminates broad-range listening and manipulation of data as it operates within the networks.

Data in cloud security is achieved:

• At Rest: Data at rest is protected through the use of strong encryption algorithms or stored in secure locations and sometimes may have other security measures such as access control and logging.
• In Transit: Transit data protection is maintained by a TLS/SSL layer that encrypts the information exchanged between your device and the cloud service.
• In Use: Data in use, is one of the relatively newer areas of interest. Technologies like homomorphic encryption and secure enclaves are being developed to make computations on encrypted data without disclosing the data itself.

Key management is an essential component of encryption. In SaaS environments, the responsibility for key management can be distributed in different ways. 

Some providers let you use customer-managed keys, and you are solely responsible for managing the keys used to encrypt your data. Some implement provider-managed keys in which the provider is responsible for the generation, storage, and management of keys. 

To minimize the risk of compromise, it is critical to change keys on a regular basis. The consumer can be restricted to options for data recovery if the provider manages the keys.

This is where your 法的合意 with the SaaS provider comes into play. It should specifically indicated or provided a clear plan on how the data will be retrieved and erased in the event of the provider’s closure or acquisition. If you use the customer-managed key, you should be able to retrieve your encrypted data and then decrypt it with your own key.