Continuing our series of posts on Enterprise Infrastructure capabilities, featured in a dedicated tab within the Blueprint dashboard, this post explores Data-in-Transit Encryption.
Data-in-Transit Encryption is a critical security control in Pega Cloud that protects all data moving between clients, services, and external systems using industry-standard encryption protocols.
What it Means
- Data-in-transit encryption ensures that all information moving across networks is encrypted end-to-end using TLS (Transport Layer Security) so that only authorized parties can read it.
- Every connection—from your browser to Pega Cloud, between Pega services, and to external integrations—is protected by strong encryption algorithms (TLS 1.2 minimum, TLS 1.3 preferred).
- If data is in transit → it is encrypted
- If data is at rest → it is also encrypted
What It Does
- Encrypts all network communication using TLS protocols:
- Protects HTTPS connections between clients and Pega Cloud servers
- Encrypts internal service-to-service communication within the infrastructure
- Secures API calls and integrations with external systems and third-party services
- Prevents man-in-the-middle attacks and eavesdropping on sensitive data
- Uses modern cipher suites with 256-bit encryption for maximum security
How It Works
- Implemented automatically across all Pega Cloud infrastructure:
- TLS Handshake: When you connect, your client and Pega Cloud servers authenticate each other and establish encrypted sessions
- Certificate Validation: Pega Cloud uses valid SSL/TLS certificates signed by trusted Certificate Authorities
- Cipher Negotiation: Client and server agree on the strongest available encryption algorithm
- Perfect Forward Secrecy (PFS): Session keys are unique to each connection, preventing past sessions from being decrypted if a key is compromised
- Continuous Monitoring: Pega Cloud logs and monitors all encrypted connections for suspicious activity
Best Practices
- Always use HTTPS URLs when accessing your Pega Cloud environment
- Verify SSL certificates are valid and match your domain names
- Keep TLS libraries and client software updated to benefit from security patches
- Configure your API integrations to enforce TLS 1.2 or higher
- Monitor connection logs for any TLS errors or downgrade attempts
- Never disable SSL/TLS verification when connecting to Pega Cloud services
Technical Documentation: Data-in-transit encryption in Pega Cloud