Encryption in transit protects a client file while it moves, from a client's phone to the firm or from the firm to a vendor. Encryption at rest protects the same file while it sits on a laptop, server, backup drive or cloud account. A firm needs both, because a file spends seconds in transit and years at rest.
What does encryption in transit protect?
Encryption in transit protects data while it travels over a network: a client uploading a W-2 from a phone, a preparer opening a cloud folder from home, or the firm sending files to a software vendor. It stops someone watching the connection from reading or changing what passes through. It stops nothing once the file lands.
Encryption here has a specific meaning. The FTC Safeguards Rule defines it at 16 CFR 314.2 on eCFR (current as of October 2026) as "the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material." In plain terms, the data is scrambled and only someone with the key can unscramble it.
In practice, in-transit encryption is usually Transport Layer Security (TLS). IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024) tells firms to use "a Secure Sockets Layer (SSL) or other secure connection" when sending sensitive financial data, and adds the IRS suggestion that "Transport Layer Security 1.1 or 1.2 is newer and more secure." The same publication says to encrypt sensitive data before sending it by email over the internet, or to use Secure File Transfer Protocol (SFTP) instead.
The rule for covered firms names both kinds. 16 CFR 314.4(c)(3) requires protecting customer information by encryption "both in transit over external networks and at rest," unless the firm's Qualified Individual reviews and approves effective compensating controls where encryption is infeasible.
What does encryption at rest protect?
Encryption at rest protects stored data: files on a laptop, a file server, a backup drive, a phone or a cloud account. If a device is lost, stolen or discarded, the files are unreadable without the key. It does not help once someone is signed in, because the system decrypts files for any authorized user.
Publication 4557 (Rev. 6-2024) lists drive encryption among the basic security software every firm needs, because it "protects information from being read on computers, tablets, laptops and smart phones if they are lost, stolen or improperly discarded." It also says to "Backup encrypted copies of client data" and to "encrypt data before uploading to the cloud." Setting up full drive encryption on each machine is one of the steps in the IRS Security Six.
The limit is the signed-in user. A laptop with drive encryption and no screen lock, left open in a coffee shop, protects nothing. Who can sign in to which folders decides what at-rest encryption is worth, which is why access controls for accounting firm staff belong in the same plan.
Where client files sit without at-rest or in-transit encryption
Client files end up unencrypted in places nobody planned: the downloads folder on a preparer's laptop, a USB drive used to move files to a scanner, a printed copy on a desk, and old messages in email archives. A firm can encrypt its main storage and still leave dozens of copies outside it. Tracing one document shows where.
Here is one fictional W-2 for an example client, Dana Moreno, followed from her phone to the firm's archive. The systems are generic; check each hop against the firm's own setup.
| Hop | Where the W-2 is | In transit or at rest | Encrypted? (example answers) |
|---|---|---|---|
| 1 | Photo in Dana's camera roll | At rest | Depends on Dana's phone lock and settings |
| 2 | Upload from Dana's phone to the firm's intake link | In transit | Yes, if the page loads over HTTPS |
| 3 | File in the firm's cloud storage | At rest | Ask the provider; see the questions below |
| 4 | Preparer downloads it to a laptop | In transit | Yes, over HTTPS |
| 5 | Copy in the laptop's downloads folder | At rest | Only if drive encryption is on |
| 6 | Printed copy for the review binder | At rest | No; paper is never encrypted |
| 7 | Copy on a USB drive for the office scanner | At rest | Only if the drive is encrypted |
| 8 | Archived file after the return is filed | At rest | Depends on the archive storage |
Hops 5, 6 and 7 are the usual gaps. Downloads folders fill up and are rarely cleaned. Paper copies need locked storage and, at the end, shredding. USB drives get lost. Each extra copy is also one more thing to destroy when the retention period ends; secure document destruction for accountants covers paper, drives and cloud copies.
Converted data counts too. When a firm turns a client's bank statements into a spreadsheet, the spreadsheet holds the same account numbers and balances as the PDF. Schema CPA reads bank statements and exports the data to Excel or CSV, and that exported file then lives wherever the preparer saves it, so it needs the same at-rest protection as the source. The workflow section of the homepage shows the export step, and the bank statements to Excel category covers the conversion itself.
Encryption questions to ask a software vendor
Encryption questions for a software vendor should establish whether client files are encrypted in transit and at rest, who holds the keys, which copies exist, and how deleted data is destroyed. A vendor that cannot answer plainly in writing is telling the firm something. The rule also requires firms to oversee service providers' safeguards.
That oversight duty is in 16 CFR 314.4(f): covered firms must take reasonable steps to select providers "capable of maintaining appropriate safeguards," require those safeguards by contract, and periodically assess them. Five questions cover the ground:
- Is every connection to your service encrypted in transit, including uploads from clients' phones and any connection to your own subcontractors? A worrying answer: "Our website uses HTTPS," with nothing about the rest.
- Is client data encrypted at rest, including backups? A worrying answer: encryption for the main database only, with backups "handled by our host."
- Who holds the encryption keys, and who on your staff can read client files? A worrying answer: no clear limit on which employees can open customer data.
- When we delete a file or close our account, how is the data destroyed, including backups? For cloud storage, NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025) notes that cryptographic erase "may be the only viable purge sanitization technique option." A worrying answer: "Deleted files are removed eventually."
- Will you put these answers in the contract? A worrying answer: anything other than yes.
A portal vendor's "end-to-end encrypted" claim needs its own scrutiny, covered in whether an encrypted client portal is encrypted end to end. Keep the written answers with the firm's security plan and ask again at renewal.