# API and Data security

**URL:** <https://discuss.dwolla.com/t/api-and-data-security/7027>\
**Category:** Authentication\
**Created:** [May 4, 2021, 1:56pm UTC](https://discuss.dwolla.com/t/api-and-data-security/7027 "2021-05-04T13:56:48Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![kmoreira](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/kmoreira/32/2718_2.png) [@kmoreira](https://discuss.dwolla.com/u/kmoreira)\
**Post date:** [May 5, 2021, 12:28pm UTC](https://discuss.dwolla.com/t/api-and-data-security/7027/2 "2021-05-05T12:28:31Z")

</div>

Hi @hshah2811

Dwolla protects sensitive data in-transit, at-rest, and throughout a transaction using a combination of cryptographic protections and tokenization. Dwolla requires strong Transport Layer Security (TLS) with downgrade protection for data in-transit. Dwolla protects data at-rest through a cryptographic service that uses strong symmetric encryption (AES 256, GCM with ongoing key rotation), and removes high-value data within a transaction using a time-based token.

For more information on Dwolla’s approach to data security visit [https://www.dwolla.com/security/](https://www.dwolla.com/security/)

---

_[View the full topic](https://discuss.dwolla.com/t/api-and-data-security/7027)._