Encryption in transit and at rest
Also called TLS, AES-GCM, encryption at rest
Scrambling data so only someone with the key can read it. In transit protects it on the wire, and that is what HTTPS does. At rest protects it on disk. Each covers one place, and neither stops a request your app treats as valid.
Saying "the data is encrypted" can be true and useless. A disk-encrypted database still hands plain text to a SQL injection. Ask who can still read it, not whether it is encrypted.
Say it to your agent
“Encrypt this token column with AES-256-GCM in the app before it reaches the database, with a fresh IV for every value and the key in our secret manager, not in the same database. Use the platform's crypto library, and add a test that a changed byte fails to decrypt.”