Data Security
Data has three states to protect — at rest, in transit, and in use — and AI has quietly become the hardest test yet for the one state security teams have always struggled with most.
What Is Data Security?
Data security is the practice of protecting digital data from unauthorized access, corruption, or theft throughout its lifecycle. It's narrower than the related, often-confused terms around it: data governance decides what data exists and who owns it; data protection covers the broader legal and procedural obligations; cybersecurity protects the systems and networks data lives on. Data security specifically concerns technical controls applied to the data itself — encryption, access restriction, secure deletion — at each point in its life.
That lifecycle is usually described in three states: data at rest (stored in a database or file system), data in transit (moving across a network), and data in use (actively being processed by an application). Security teams have historically gotten quite good at protecting the first two — encryption at rest and in transit are close to table stakes today. Data in use has always been the hardest state to secure, because an application typically needs the data decrypted and readable to actually do anything with it — and AI has made this the newest, most active front in that long-standing challenge.
Practical Industrial Use
A fintech company with mature data security practices might have its transaction database fully encrypted at rest and every connection encrypted in transit via TLS — a genuinely strong baseline. But when that company deploys an AI-powered fraud-detection copilot, the same customer and transaction data now has to be decrypted and reasoned over by the AI model to do its job — meaning it enters the "in use" state, and often leaves the organization's own infrastructure entirely to reach an external inference API.
This is the exact gap that data-in-use protection has always struggled with, now amplified by AI: previously, "in use" meant a local application reading decrypted data internally. Now it can mean that same decrypted data being transmitted to a third-party model, processed by infrastructure the sending organization doesn't control, and potentially logged or retained at the other end — a materially different, and materially larger, exposure than a local application ever created.
What Happens Without It
Organizations that have genuinely strong at-rest and in-transit security often assume that coverage extends automatically to whatever new technology they adopt — including AI. It doesn't. Encryption at rest protects data sitting in a database; it says nothing about what happens to that data once it's decrypted and sent, in readable form, to an AI model for inference.
⚠ Risk Without Full-Lifecycle Data Security A company can have excellent at-rest and in-transit security and still expose sensitive data completely once it reaches the "in use" stage of an AI interaction, because that stage was historically the hardest to protect and AI has expanded what "in use" actually means. The data isn't stolen through a security failure in the traditional sense — it's sent, deliberately, as part of normal AI processing, simply without the same protective treatment applied to its other two states. Regulators evaluating a data exposure don't care which lifecycle stage it occurred in; a leak during AI inference carries the same GDPR or HIPAA consequences as one from an unencrypted database.
With Full-Lifecycle Data Security
- Protection extends across all three states — at rest, in transit, and in use
- AI inference is treated as a distinct, protected stage, not an unmonitored gap
- Existing at-rest and in-transit investment isn't undermined by a new blind spot
- Data stays protected consistently, regardless of which system is processing it
Without It
- Strong at-rest and in-transit security creates false confidence about total coverage
- Data decrypted for AI inference is exposed in a way older security models didn't anticipate
- The most historically vulnerable data state is now also the most actively used one
- A gap in one state undermines the value of strong protection in the other two
Data security was never really "finished" even before AI — data in use was always the unresolved piece. AI just made that piece impossible to ignore.
How This Relates to Questa AI
Questa AI is built specifically to close the data-in-use gap that AI has widened. Rather than leaving the "in use" state unprotected the way many traditional security architectures still do, Questa AI anonymizes sensitive data at the exact moment it would otherwise be decrypted and exposed to an AI model — extending the same protective discipline organizations already apply to data at rest and in transit into the AI inference stage itself.
This means a company's existing investment in encryption and network security doesn't get undermined the moment it adopts an AI tool. The data that was protected while stored and protected while moving stays protected while being reasoned over by a model, closing the lifecycle gap rather than leaving it as the one unaddressed stage.
Frequently asked questions
Data at rest (stored in a database, file system, or backup), data in transit (moving across a network between systems), and data in use (actively being processed by an application or, increasingly, an AI model). Each state requires a different kind of protection, since encryption alone can secure the first two but data has to be readable to be used in the third.
Data security refers specifically to technical controls protecting the data itself, such as encryption and access restriction. Data protection is a broader term that also includes legal and procedural obligations, like conducting required impact assessments, alongside the technical measures data security provides.
Cybersecurity protects the broader systems, networks, and infrastructure that data lives on and moves through. Data security is more narrowly focused on protecting the data itself throughout its lifecycle, regardless of which specific system or network it happens to be sitting in or passing through at a given moment.
Data generally has to be decrypted and readable for any application, including an AI model, to actually process it, which means the strong protections available for data at rest and in transit don't directly apply once it's being actively used. AI intensifies this because "in use" now often means sending decrypted data to an external inference service, rather than just a local application reading it internally.
No. Encryption at rest protects data while it's stored and unused. Once that data is retrieved, decrypted, and sent to an AI model for processing, it's in the "in use" state, which at-rest encryption doesn't cover. A separate protection, such as anonymization applied at the point of AI processing, is needed to protect data during that stage specifically.
Related terms
Encrypted Storage
Storing data in a form unreadable without a decryption key, protecting it both at rest and in transit.
Cybersecurity
The foundation layer that has to hold regardless of how good your AI privacy controls are — because anonymized data behind a broken lock is still exposed data.
Data Protection
Not just a technical outcome — under laws like GDPR, "data protection" is a legal process with specific paperwork, and skipping it is a violation even if nothing ever leaks.
AI Anonymization
The process of masking sensitive data before it ever reaches an AI model — and restoring it afterward, only for the people who are allowed to see it.
Access Control
The rules that decide who — and what, including an AI model — is allowed to see a given piece of data, and the boundary that keeps everyone else out.
Data Governance
You can't protect what you haven't mapped — data governance is the inventory and rulebook that makes every other privacy control possible to apply precisely.
See Data Security in practice
Questa AI anonymizes sensitive data before it reaches any AI model — across documents and live prompts, with governance and data-residency control.