---
title: "Encrypt data on the wire and on disk · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/cryptography-and-keys/encrypt-data
id: APS-54
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 963
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Encrypt data on the wire and on disk

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-54
- Level: Required
- Chapter: [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md)
- Rule: Encrypt every connection, including those between your own servers. Encrypt stored personal data and backups.
- Check: The agent tries a plain connection to the database and cache from inside staging. Both refuse it, and so does a TLS 1.1 connection. The backup files cannot be read without a key.
- Risk: Data leaked or lost
- How: Use TLS 1.2 or 1.3 for the database, cache and internal services, not only for visitors, and verify the server's certificate. Turn on disk or database encryption, and encrypt backups. Store passwords as [slow hashes](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/password-storage.md). For public TLS settings, see the [website TLS rule](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/tls-configuration.md). For more depth, see [encrypted backups](https://agentwranglers.se/playbook/data/database-security/encrypted-backups.md) and [field encryption](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md).

## Sources

- [OWASP Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html)

## Related rules

- DAT-41 [Give the app a least-privilege database user](https://agentwranglers.se/playbook/data/database-security/app-database-role.md) in Data and databases
- DAT-26 [Encrypt backups](https://agentwranglers.se/playbook/data/database-security/encrypted-backups.md) in Data and databases
- INF-33 [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services.md) in Infrastructure and environments
- APS-23 [Make browsers always use HTTPS](https://agentwranglers.se/playbook/application-security/browser-security-headers/hsts.md) in Application security
- APS-24 [Load nothing over plain HTTP](https://agentwranglers.se/playbook/application-security/browser-security-headers/mixed-content.md) in Application security
- APS-11 [Store passwords with a slow hash](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/password-storage.md) in Application security
- APS-55 [Turn off old encryption](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/tls-configuration.md) in Application security
- APS-58 [Encrypt the most sensitive fields](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md) in Application security
- APS-57 [Keep encryption keys in a key service](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/key-management.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/cryptography-and-keys/encrypt-data">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Next: [Turn off old encryption](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/tls-configuration.md)
- [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md)