Does encryption in transit prevent eavesdropping on public Wi-Fi?

Yes. By using encrypted connections (such as HTTPS or TLS), traffic travelling from your device to the server is scrambled, so no one on that local network can read your emails or passwords.

If a service uses encryption at rest, does that mean no one can see my data?

Encryption at rest protects information if someone physically steals the drives or accesses the raw storage. However, authorised systems and anyone with your password can still view the decrypted data.

Is encryption mandatory under GDPR?

The GDPR does not mandate a specific technology, but it does require appropriate technical and organisational measures to ensure security, explicitly citing encryption as a benchmark practice.

Published on 2 October 20263 min readMadrugo team

Encryption at rest and in transit: what each one protects

Encryption in transit protects data on the move, while encryption at rest secures stored files. Here is what each one does and what neither can prevent.

Email Calendar and tasks Privacy

The short answer: encryption in transit protects your data as it travels between your device and servers; encryption at rest protects it once stored on a disk or database. Neither replaces the other: they are complementary, essential layers ensuring no one reads your emails, calendar events, or tasks without authorisation.

In technical specifications and security policies for any modern app, you will constantly see these two concepts mentioned. Although both rely on mathematical algorithms to scramble readable data into an unreadable cipher, they operate at completely different stages of the information lifecycle.

In transit: a sealed tunnel across the network

Every time you open your inbox, check your calendar, or tick off a task, your device exchanges data with one or more servers across the internet. That information travels through cables, mobile masts, telecoms switching centres, and home or public Wi-Fi routers.

Encryption in transit (usually via protocols like TLS or HTTPS) ensures that data travels inside a sealed tunnel:

Prevents eavesdropping: if you connect to Wi-Fi in a hotel, café, or airport, no one on that same network can intercept your credentials or read the content of your messages as they are transmitted.
Guarantees integrity: it confirms that data sent by your phone or computer arrives at the server unaltered, without any intermediary tampering with it along the way.
Authenticates the destination: it allows your device to verify it is communicating with the genuine service server rather than an impostor.

Once the data packet reaches its destination and enters the server, the server decrypts it so it can be processed. That is where encryption in transit ends its job.

At rest: the vault for servers and storage

Once data has reached the server—or when stored locally on your computer or phone—it is saved onto physical media: hard drives, solid-state drives (SSDs), or backups.

Encryption at rest protects precisely these stored files and physical drives:

Protects against physical theft: if someone steals a drive from a data centre or takes a laptop from an office, they cannot read the information simply by extracting the drive, because the files are locked with a cryptographic key.
Secures backups: database backups archived for disaster recovery remain encrypted against potential leaks or mishandling.
Isolates environments: it ensures that data from different customers or cloud services cannot be read across accounts at the physical storage level.

What neither of them protects against

Having encryption in transit and at rest is the baseline standard required by GDPR for handling personal data responsibly. However, it does not mitigate every risk:

Stolen credentials: if an attacker obtains your password through a prior breach or phishing attack, the system will identify them as a legitimate user and serve up the decrypted data.
Excessive permissions: if you authorise a third-party app to access your account, that app will read your data through official channels. In our privacy section, we often emphasise checking what permissions an app that reads your email asks for before granting access.
Compromised devices: if your phone or laptop has malware recording your screen or keystrokes, an attacker sees the data at the very moment you do.

Where data is stored and who decrypts it

For a service to organise your schedule, filter your email, or generate a daily digest, it must temporarily decrypt information in memory to interpret it. What matters here are the technical and organisational safeguards around that processing.

At Madrugo, for instance, both servers and databases are hosted within the European Union. Information always travels encrypted and is stored encrypted at rest. For automated summary features, the daily briefing relies on AI models that may process text outside the EU; however, this AI can be switched off completely in the settings if you prefer the summary to be generated solely on the internal server. All details on data retention and handling are clearly outlined in our privacy policy.

Frequently asked questions

Does encryption in transit prevent eavesdropping on public Wi-Fi?: Yes. By using encrypted connections (such as HTTPS or TLS), traffic travelling from your device to the server is scrambled, so no one on that local network can read your emails or passwords.
If a service uses encryption at rest, does that mean no one can see my data?: Encryption at rest protects information if someone physically steals the drives or accesses the raw storage. However, authorised systems and anyone with your password can still view the decrypted data.
Is encryption mandatory under GDPR?: The GDPR does not mandate a specific technology, but it does require appropriate technical and organisational measures to ensure security, explicitly citing encryption as a benchmark practice.