---
title: "Encrypt data on the wire and on disk · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data
updated: 2026-10-20
licence: "All rights reserved"
---

# Encrypt data on the wire and on disk

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Encrypt every connection, including those between your own servers. Encrypt stored personal data and backups.
- How: Use TLS for the database, cache and internal services, not only for visitors. Turn on disk or database encryption, and encrypt backups. Store passwords as [slow hashes](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-storage). For public TLS settings, see the [website TLS rule](https://agentwranglers.se/playbook/website/hosting-and-network/tls-configuration). For more depth, see [encrypted backups](https://agentwranglers.se/playbook/data/backups-and-recovery/encrypted-backups) and [field encryption](https://agentwranglers.se/playbook/data/personal-data/field-encryption).
- Check: The agent tries a plain connection to the database and cache from inside staging. Both refuse it. The backup files cannot be read without a key.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data`.

- Previous: [Keep private data out of logs and addresses](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-data-out-of-logs)
- Next: [Give each key the least power](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/least-privilege-keys)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)