# DAT-08 Encryption at rest and in transit

Domain: DAT Data Protection & Privacy · HI-AAF v1.3 · Public review · https://humanintel.net/standard/dat/dat-08

Encryption is applied at rest and in transit to all agent-related data, including prompts, completions, traces, and memory.

All agent-related data, prompts, completions, traces, memory stores, configuration, is encrypted at rest and in transit using current cryptographic standards. This includes data held by third-party providers. Encryption is verified, not assumed, and key management follows documented procedures.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for DAT-08: Encryption is applied to all agent-related data stores and transit paths; encryption is verified by audit or automated scan; key management procedures are documented and followed.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Encryption is applied to all agent-related data stores and transit paths.
- Encryption is verified by audit or automated scan.
- Key management procedures are documented and followed.

## Framework mappings

- ISO/IEC 42001: A.7.4
- SOC 2 (TSC): CC6.1, CC6.7
- EU AI Act: Art. 10(2)
- Singapore: PDPA s.24, AI Verify Data Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, DAT-08 Encryption at rest and in transit. Public review edition, July 2026. https://humanintel.net/standard/dat/dat-08