KARLSONLet's talk

Part 2 · Encryption

Encryption at rest, in transit and in use: the three states of data

Data is either stored, moving or being processed. Encryption at rest and in transit are solved problems. Encryption in use is where your privacy is decided.

By · Updated · 7 min read

On this page

Short answer

Encryption at rest protects stored data, encryption in transit protects data moving between systems, and encryption in use protects data while it is being processed. The first two are solved with standards like AES and TLS 1.3. The third is the open problem: most services still decrypt your data to work on it, so you have to trust whoever runs the computation.

Key takeaways

  1. Data exists in three states: at rest, in transit and in use. Each needs its own protection.
  2. At rest and in transit are solved with AES-256 and TLS 1.3. The real question for stored data is who holds the keys.
  3. Quantum-safe key exchange is now the default in major browsers and operating systems, to defeat harvest now, decrypt later.
  4. Encryption in use is the open problem. When a service decrypts your data to process it, its privacy policy is your only protection.

Privacy-preserving technology matters for all AI, and twice as much for personal AI. The foundation is encryption: with cryptographic keys, data is turned into ciphertext that only someone holding the right key can turn back into readable form.

To understand where your data is protected and where it is not, it helps to think of data as always being in one of three states:

  1. At rest: stored on a disk, in a database or in a backup.
  2. In transit: moving between your device and a server, or between servers.
  3. In use: loaded into memory and being processed.

Each state has its own threats and its own tools. Two of them are, for practical purposes, solved. The third is where your privacy is actually decided.

The three states of data Data at rest and in transit are encrypted with standard tools. Data in use is usually decrypted in memory, which is where the provider can read it. AT REST Stored AES-256 · solved IN TRANSIT Moving TLS 1.3 · solved IN USE Processed Usually decrypted · open The provider can read your data in the dark box unless it uses confidential computing or similar.
Data moves between three states. Standard encryption covers the first two.

1. Encryption at rest: securing stored data

Data at rest is data that is neither moving nor being used: your messages in a database, your photos in cloud storage, a patient record on a hospital server. Encrypting it is routine with a vetted standard. AES-256 (the Advanced Encryption Standard with 256-bit keys) is the default almost everywhere, and every major cloud encrypts stored data by default.

So the technical part is solved. The question that matters is who holds the keys:

  • Provider-managed keys. The provider encrypts your data and keeps the keys. This protects you against a stolen disk, but not against the provider itself or anyone who can compel it.
  • User-held keys (end-to-end or zero-access encryption). Your device holds the keys, and the provider stores ciphertext it cannot read. Signal, WhatsApp messages and Apple’s Advanced Data Protection for iCloud work this way.

Who holds the keys is not only a technical choice. In February 2025 Apple stopped offering Advanced Data Protection to new users in the UK rather than build the access the British government had demanded. When the provider does not hold the keys, the only way to reach the data is to change the product, and that becomes visible.

2. Encryption in transit: securing data on the move

Every time you send a message, submit a form or talk to a cloud-based AI assistant, data travels across networks you do not control. Encryption in transit makes sure only the intended endpoints can read it. The main protocols:

  • TLS 1.3 (Transport Layer Security), the protocol behind HTTPS. It replaced SSL, which is obsolete and should no longer be used.
  • SSH (Secure Shell) for remote logins and administration.
  • IPsec and WireGuard for virtual private networks.

Underneath most of these sits asymmetric, or public-key, cryptography: a public key that anyone can use to encrypt or verify, and a private key that only its owner holds. A public key infrastructure (PKI) of certificate authorities vouches for who owns which key, which is what the padlock in your browser represents. The same idea secures digital signatures and blockchains.

The quantum update

The biggest change since the first version of this article is post-quantum cryptography. A sufficiently large quantum computer would break the public-key algorithms that protect key exchange today. That makes harvest now, decrypt later a real risk: traffic recorded today could be decrypted in ten years. For a personal AI that holds a lifetime of conversations, ten years is not long.

The industry has moved fast here:

  • In August 2024 NIST published the first post-quantum standards: FIPS 203 (ML-KEM) for key exchange and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. In March 2025 it selected HQC as a backup key-exchange algorithm.
  • Hybrid key exchange, which combines the classical X25519 with ML-KEM, is now on by default in Chrome and Edge, Firefox and Safari, and on by default across Apple’s 2025 operating systems for apps and services using its standard networking APIs.
  • By the end of 2025, more than half of the human web traffic Cloudflare handles used post-quantum encryption.
  • Messaging followed: Apple’s iMessage has used its PQ3 protocol since 2024, and in October 2025 Signal added a post-quantum ratchet (SPQR) on top of its existing protocol.
  • Cloudflare now aims to be fully post-quantum, including authentication, by 2029, and Google has moved its own migration target to 2029.

For in-transit encryption, in other words, the industry has not only solved today’s problem but is well underway with tomorrow’s.

3. Encryption in use: working on your data securely

This is where you should pay attention, and where personal AI needs the most work.

Your data is processed constantly: when an app suggests how to sleep better, when a map finds a route, when a feed decides what to show you, and every time an AI assistant reads your message and your memory to answer. To compute on data, a traditional system needs it in plaintext. So in almost every case, your data is decrypted in the provider’s memory before anything happens to it.

That makes the provider, and everyone with access to its systems, a party you must trust. Encryption at rest and in transit protects you from outsiders. It does nothing against the party doing the computation.

Who do you trust with your data?

It is an old dilemma: utility or security. Data is not useful unless something is done with it, so we have accepted the trade-off.

Take LinkedIn. You share your career, your network and your ideas so it can help you connect and be found. Then a familiar dance starts:

  • You try to share only what is needed. No reason to post about the family picnic.
  • The platform writes policies and complies with GDPR so you feel comfortable sharing more.
  • More data gives you a better experience, and the platform nudges you to share more, with visibility to recruiters as the reward. Soon the family picnic is a post about being a good colleague.
  • Regulators step in to give you rights. It helps, but what companies say publicly and what they do internally are not always the same.

That last point has since become concrete. In September 2024 it emerged that LinkedIn had begun using US members’ data to train generative AI before updating its terms. From 3 November 2025 it extended this to members in the EU, EEA, UK, Switzerland, Canada and Hong Kong, switched on by default with “legitimate interest” as the legal basis. Opting out stops future use but does not remove what was already collected.

And there is always someone inside the organisation who can access your data. The privacy policy usually says so. LinkedIn’s, like most, reserves the right to disclose information “when required by law, subpoena, or other legal process or if we have a good faith belief that disclosure is reasonably necessary.”

Now apply that to personal AI. The largest AI services have moved in the same direction. Anthropic asked Claude’s consumer users in 2025 to choose whether their chats may train models, with five years of retention for those who agree. Meta uses conversations with Meta AI to personalise ads in most markets. OpenAI has said it plans client-side encryption for ChatGPT, but as of this update the “locked chats” it began rolling out in October 2026 protect access on your device with a PIN, not your data from OpenAI. Picture ten years of your behaviour, worries and deepest thoughts hosted by a company with no encryption in use and the same “good faith belief” clause.

That is why encryption in use is the holy grail. Your personal data will be one of the most valuable assets of the coming decade, and mastering encryption in use is what makes it possible to use that data without handing it over.

Summary: the three states in 2026

State What it protects Standard tools Status in 2026 The open question
At rest Stored data AES-256, key management, end-to-end encryption Solved Who holds the keys
In transit Data moving across networks TLS 1.3, SSH, IPsec, WireGuard, hybrid post-quantum key exchange Solved, quantum migration well underway Migrating long-lived data and signatures
In use Data being processed Confidential computing, on-device processing, homomorphic encryption, MPC, zero-knowledge proofs Partly solved, depending on the workload Running large AI models without trusting the operator

In part 3 we go through the five technologies that can protect data in use, how far each has come since 2025, and which ones work for AI today.

Frequently asked questions

What is the difference between encryption at rest, in transit and in use?

Encryption at rest protects data stored on a disk or in a database. Encryption in transit protects data while it moves across a network. Encryption in use protects data while it is being processed in memory. At rest and in transit are routine today. In use requires special technologies such as confidential computing or homomorphic encryption.

Is my data safe if a service says it is encrypted?

Not necessarily. Most services encrypt data at rest and in transit but hold the keys themselves and decrypt the data to process it. Encryption then protects you against outside attackers, but not against the provider, its employees, a court order or a policy change.

What is end-to-end encryption?

End-to-end encryption means data is encrypted on your device and can only be decrypted on the devices of the intended recipients. The service in between stores and forwards ciphertext it has no keys for.

What does harvest now, decrypt later mean?

It is the risk that an attacker records encrypted traffic today and decrypts it years from now with a quantum computer. Post-quantum key exchange, such as the hybrid ML-KEM schemes now used by major browsers, is designed to prevent it.

Sources

  1. Apple Support: Advanced Data Protection in the United Kingdom: Apple can no longer offer Advanced Data Protection to new UK users
  2. NIST: HQC selected as fifth post-quantum algorithm (March 2025): HQC as backup to ML-KEM
  3. quantum.gov: NIST releases post-quantum encryption standards (August 2024): Release of the first post-quantum standards
  4. Cloudflare: Post-quantum support in browsers and clients: X25519MLKEM768 on by default in Chrome, Edge, Firefox and Safari
  5. heise: Cloudflare Year in Review 2025: 52% of human traffic using post-quantum encryption
  6. Cloudflare: Post-quantum roadmap: Harvest now, decrypt later and the 2029 target
  7. The Quantum Insider: Google shortens its quantum-safe timeline (March 2026): Google's 2029 migration target
  8. Apple Platform Security: quantum-secure cryptography: iMessage PQ3 and quantum-secure TLS in Apple's 26 releases
  9. Signal: SPQR, the sparse post-quantum ratchet (October 2025): Signal's post-quantum Triple Ratchet
  10. TechCrunch: LinkedIn trained on user data before updating its terms (September 2024): LinkedIn's 2024 AI training on US member data
  11. TechRadar: LinkedIn expands AI training on user data (November 2025): The 3 November 2025 expansion and legitimate interest
  12. Privacy Guides: OpenAI plans client-side encryption for ChatGPT (November 2025): OpenAI's stated encryption plans
  13. AI Weekly: ChatGPT adds PIN-locked chats, not end-to-end encrypted (October 2026): Locked Chats do not change OpenAI's access

Privacy in Personal AI: all parts

  1. Part 1Why privacy matters more in personal AI than anywhere else
  2. Part 2Encryption at rest, in transit and in use: the three states of data
  3. Part 3Encryption in use: five technologies that protect data while AI works on it
  4. Part 4Confidential AI in practice: how Apple, Google and Meta process AI requests privately
  5. Part 5How to build or choose a private personal AI

Next: Part 3, Encryption in use: five technologies that protect data while AI works on it

Working on AI with sensitive data?

Let's find the right architecture.

I help companies decide what should run locally, what can run in a confidential cloud and what should not be built at all.

AI strategy (in Danish) yngvikarlson@gmail.com