Sensitive data is vulnerable in two states: when it is stored somewhere, and when it is moving across a network. Encryption at rest and encryption in transit are the two protections that address each, and serious systems need both, because securing one while leaving the other exposed leaves the door open.
Encryption in transit protects data as it moves, between a user's browser and a server, or between systems. The familiar example is TLS, the technology behind the padlock and HTTPS, which scrambles data so that anyone intercepting it on the network sees nothing usable. Without it, information travels in the open and can be read or altered in flight.
Encryption at rest protects data while it is stored, in databases, files, and backups, so that if the storage itself is stolen or accessed improperly, the data is unreadable without the keys. Strong algorithms and careful key management are what make it meaningful; encryption whose keys are poorly protected offers false comfort.
Regulations and frameworks like HIPAA, PCI, and SOC 2 expect both, because a gap in either state is a real exposure. And the hardest part of encryption is rarely the math; it is key management, how keys are generated, stored, rotated, and access-controlled. Encryption is only as strong as the protection around its keys, which is where good engineering earns its keep.
Protect it moving and standing still.
This is general educational information, not specific security, compliance, or legal advice for your systems.