# Encryption

> eStealth encryption: TLS for data in transit, encryption at rest, and optional hardware security modules (HSM).

> Keep data safe through out-of-the-box encryption. A strong security architecture thwats data theft.

# Data in Transit
All communication between the eStealth vault and SDK are encrypted using SSL or TLS.

# Data at Rest
The data stored in the vault is encrypted before it gets written into storage.
This ensures, that a attacker cannot learn anything from stolen hardware or stolen backups.

# HSM
For added security, a hardware security module (HSM) may be used to ensure data can only be decrypted online. 
This makes it very easy to detect unwanted access.