AI Vocabulary

Encrypted: yes, but at which moment?

Encryption at rest protects data stored on a disk. Encryption in transit protects it while it travels across a network. Neither protects it during processing: at that moment it is necessarily in clear. That is where the question a lawyer should be asking sits.

The three moments

In transit, data travels encrypted between your machine and the server. That has been a universal web standard for years, and a provider not doing it would be disqualified outright. Presenting it as an argument is itself a signal.

At rest, stored data is encrypted on the disks. That protects against physical theft of a device and against direct access to storage. It is necessary and has also become unremarkable.

During processing, however, the machine must read the text to do anything with it. Decryption is therefore unavoidable, and it is at that instant that the data is accessible.

What end-to-end covers

End-to-end encryption means only the sender and the recipient can read — the provider carrying the message cannot, even if it wished to.

That property sits awkwardly with AI processing, for a simple reason: the system must read in order to analyse. A provider announcing end-to-end encryption on an analysis service is describing either something else or a particular architecture, which is worth having explained.

A concrete case

You submit a draft instrument to an analysis service. The file leaves your machine encrypted in transit, arrives on the provider's servers, is decrypted to be read and analysed, and the answer travels back encrypted to you.

Between decryption and re-encryption, your instrument existed in clear in the memory of a machine you do not control. That is unavoidable, it is normal operation, and it is precisely the window the confidentiality question bears on.

Hence the interest of substituting identifying elements before sending: what sits in clear during that window is then a legal structure whose subject is unknown.

The questions that replace the word

While the data is in clear, who can technically reach it? A system administrator, a support team during an incident, an operator of the hosting platform?

How long does it stay in clear, and what remains after processing — nothing, a log entry, a working copy?

And who holds the encryption keys? If the provider does, encryption at rest protects you from an outside third party, not from the provider itself.

What it does not solve

Encryption protects against unauthorised access, not against authorised use. A provider holding the keys and lawfully exploiting your data under its terms need circumvent no encryption.

Nor does it protect against a misconfiguration of access rights, which is the most frequent cause of observed incidents — well ahead of failing cryptography.

And it says nothing about location: perfectly encrypted data may sit under a jurisdiction allowing an authority to demand its production, keys included.

Why it matters to a lawyer

Because your data is encrypted is the standard answer to a question about confidentiality, and it is accurate while leaving the question untouched.

The useful formulation is therefore: at what moment is my data in clear, and who can then access it? A serious provider answers precisely; an approximate one answers by repeating the word encryption.