# Encryption in Transit

> A mechanism that encrypts traffic between parties with TLS or mutual TLS and verifies the peer's certificate.

Record: `architecture:encryption-in-transit`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: network, service communication
Canonical: https://banes-lab.com/ontology#architecture-encryption-in-transit

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Encryption at Rest](https://banes-lab.com/records/architecture/encryption-at-rest.md) and before [Secrets Management](https://banes-lab.com/records/architecture/secrets-management.md).

## Repair

- Refactored by: Enable TLS/mTLS
- Detected by: HTTP/plain socket usage
- Violated by: sensitive traffic over plaintext
- Measured by: encrypted transport coverage
- Enforced by: gateway/network policy

## Requires

- [TLS/mTLS](https://banes-lab.com/records/lexicon/tls-mtls.md)

## Reinforces

- [Confidentiality](https://banes-lab.com/records/lexicon/confidentiality.md)
- [Integrity](https://banes-lab.com/records/lexicon/integrity.md)

## Enables

- [Secure Communication](https://banes-lab.com/records/lexicon/secure-communication.md)

## Conflicts with

- [Plaintext Transport](https://banes-lab.com/records/lexicon/plaintext-transport.md)

## In tension with

- [Certificate Management](https://banes-lab.com/records/lexicon/certificate-management.md)

## Tensions

- [Encryption in Transit / Certificate Management](https://banes-lab.com/records/tension/certificate-management-encryption-in-transit.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Enforced by

- [rules/eslint/no-plaintext-transport.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/no-plaintext-transport.eslint.rule.ts.md)

## Linked from

- [The deploy is a file operation](https://banes-lab.com/disciplined-methodology/ship/the-deploy-is-a-file-operation.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)

## Evidence in the code

- [rules/eslint/no-plaintext-transport.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/no-plaintext-transport.eslint.rule.ts.md)