Encryption in transit Protecting data while it moves from one device to another.
Short answer. Encryption in transit protects data while it moves between devices, so someone on the network path cannot read or alter it. On the web the mechanism is Transport Layer Security (TLS), which the IETF describes as designed to prevent eavesdropping, tampering and message forgery. NIST’s guidelines for US government servers say they must use TLS 1.2, should also use TLS 1.3, and must not use TLS 1.0, SSL 3.0 or SSL 2.0. Inside an office, “it is on our own network” does not mean encrypted: a laptop talking to an AI server over office Wi-Fi should still use HTTPS. An address that starts with http:// instead of https:// is the warning sign.
01
What TLS gives you
RFC 8446, which defines TLS 1.3 (August 2018), lists three properties of the secure channel: authentication of the server, confidentiality of the data and integrity, meaning that changes made by an attacker are detected. The RFC says these should hold even against an attacker who has complete control of the network.
NIST SP 800-52 Revision 2 (August 2019) gives US government guidance on choosing and configuring TLS. It requires US federal agencies to support TLS 1.3 from 1 January 2024.
02
Where an AI server is exposed
Hop
Example
What should protect it
Staff device to AI server
A browser on office Wi-Fi opens the AI web app
HTTPS with a certificate the browser trusts
Application or agent to model endpoint
A script sends prompts to an OpenAI-compatible endpoint
HTTPS, plus a key per user or agent
AI server to a cloud service
An optional cloud model or an online lookup
HTTPS to the provider; a log showing which calls left the box
AI server to a connector
A remote MCP server
HTTPS, with the token authentication that MCP’s remote transport supports
Administrator sessions
Remote management of the box
An encrypted channel from a named administrator account
Backups
A copy sent to another machine or site
Encrypted transfer and encrypted storage
03
Inside the office network
Many offices treat the internal network as safe. NIST’s zero trust publication disagrees. It says network location alone does not imply trust, that access requests from inside a legacy perimeter must meet the same security requirements as any other, and that all communication should be secured regardless of network location. Anyone who joins the Wi-Fi, plugs in a laptop or compromises one device is on the same network as the AI server.
The OAuth specification for bearer tokens, the kind API keys are, makes TLS mandatory for the same reason: a token sent in clear can be copied by anyone who sees it.
04
A short checklist
Serve everything over HTTPS, and redirect or disable plain HTTP.
Allow TLS 1.2 and 1.3. Turn off SSL and TLS 1.0, and TLS 1.1 unless an old device genuinely needs it.
Use certificates that staff devices trust, from a public authority or from your own internal authority installed on managed devices. Staff who learn to click through certificate warnings stop noticing real attacks.
Renew certificates before they expire, and monitor expiry dates.
Encrypt traffic between your own servers as well, not only at the edge.
Check that every call to a cloud model uses HTTPS: the destination should begin with https://.
05
Where ANVE stands
ANVE is a device on the office network, so staff requests reach it over the network, and any optional cloud model or online lookup crosses the internet. Cloud models exist only if an administrator adds a provider, according to ANVE’s security page (/security), and every model call is logged with whether it ran locally or in the cloud. ANVE’s TLS settings are a question to settle in writing before a paid pilot.
06
Questions people ask
Is TLS the same as SSL?
TLS is the successor to SSL. NIST’s guidelines describe TLS 1.0 as an improvement to SSL 3.0, and say government servers must not use SSL 2.0 or 3.0.
Do I need encryption inside my own office?
Yes, for anything sensitive. NIST’s zero trust guidance says network location alone does not imply trust and that communication should be secured whatever the network.
Does https:// mean a site is safe?
It means the connection is encrypted and the server presented a certificate the browser accepts. It says nothing about whether the organisation behind the site is trustworthy.
Does encryption in transit protect data on the server?
No. It protects the journey. Once the data arrives it is decrypted for use, so encryption at rest and access control still matter.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
