TLS (Transport Layer Security): A cryptographic protocol that encrypts and authenticates data in transit between two systems, such as a browser or app and a server, protecting it from eavesdropping and tampering on the network.
Also known as: Transport Layer Security, SSL (its older predecessor), HTTPS (HTTP over TLS)
Key takeaways
- TLS protects data in transit: from your device to the server and back.
- It encrypts the connection, verifies the server's identity with a certificate and detects tampering.
- TLS 1.2 and 1.3 are the current versions; older SSL and early TLS versions are deprecated.
- TLS alone does not protect data once it is stored on the server; that is the job of encryption at rest.
- C Chat uses TLS in transit and AES-256 at rest with per-organization keys.
Every time you open a website with “https” or send a message from a modern app, TLS is probably working in the background. It is so common that it is easy to forget what it actually does, and what it does not.
TLS (Transport Layer Security): a plain definition
TLS is a protocol, a set of rules two systems follow to talk securely over an untrusted network such as public Wi-Fi or the internet. It provides three guarantees:
| Guarantee | What it means |
|---|---|
| Confidentiality | Others on the network cannot read the data |
| Integrity | Data cannot be altered in transit without detection |
| Authentication | Your device can verify it is talking to the real server, through a certificate |
TLS replaced SSL in 1999. Today the recommended versions are TLS 1.2 and TLS 1.3; earlier versions are deprecated.
How it works
A TLS connection starts with a handshake:
- Hello. The device and the server agree on a TLS version and a set of algorithms.
- Certificate. The server presents a certificate proving it controls the domain, signed by a trusted authority.
- Key agreement. Using public-key cryptography, both sides derive a shared secret without ever sending it over the network.
- Encrypted session. The rest of the conversation is encrypted with a fast symmetric cipher, commonly AES (see AES-256).
TLS 1.3 uses key exchanges that provide forward secrecy, so recorded traffic cannot be decrypted later even if a server’s long-term key is compromised.
Why it matters for business messaging
Field teams send messages from mobile networks, hotel Wi-Fi and customer sites. Without TLS, anyone on the same network could read or modify those messages. With TLS, the network sees only encrypted traffic going to the service.
TLS covers only one part of the journey, though. It is a form of encryption in transit: once data reaches the server, it is decrypted for processing and storage. Protecting it there is a separate job, called encryption at rest. A complete answer to “is it encrypted?” covers both.
TLS is also different from end-to-end encryption. With TLS, the service provider’s server is an endpoint of the connection. With end-to-end encryption, only the communicating devices are.
How it relates to C Chat
C Chat sends all traffic between its apps, its web app at getcchat.com/c and its servers over TLS. Stored messages are then encrypted at rest with AES-256 using a key that belongs to your organization. Read TLS in C Chat: how messages travel protected and how C Chat encrypts your messages for the complete picture.
Because C Chat uses auditable encryption rather than end-to-end encryption, the service can make your team’s group conversations available to your owners and admins for audit and export. Direct messages between people stay private, and the platform only accesses content to moderate reported messages or for legal requirements, with that access logged. The trade-offs are explained in auditable encryption vs end-to-end encryption, and per-organization keys explained describes how stored data is separated between organizations.
Related terms and common misconceptions
- “HTTPS means the data is safe forever.” It means the data was protected on the way. Storage protection is a separate question.
- “TLS is only for websites.” Mobile apps, APIs, email servers and messaging services all use TLS.
- “A padlock means the site is legitimate.” Phishing sites can have valid certificates too. The padlock confirms the connection, not the intent.
When reviewing any messaging vendor, ask which TLS versions they accept and what protects data after it arrives. The vendor security questionnaire and how to evaluate a vendor’s encryption claims list the right questions.
Getting started
You do not need to configure anything to benefit from TLS in C Chat: it is on for every connection. Open the web app at getcchat.com/c, sign up with your phone number or email and create your team.
Frequently asked questions
Is TLS the same as SSL?
TLS is the successor to SSL. People still say SSL out of habit, for example SSL certificate, but the SSL protocol versions are obsolete and modern systems use TLS 1.2 or 1.3.
Does TLS mean my messages are end-to-end encrypted?
No. TLS protects each connection between a device and a server, so the server can read the data once it arrives. End-to-end encryption is a different model in which only the communicating devices hold the keys.
What does the padlock in the browser mean?
It means the connection to that website uses TLS and that the site presented a valid certificate for its domain. It says the connection is protected; it does not say the site itself is trustworthy.
How does C Chat use TLS?
All traffic between the C Chat apps or web app and C Chat's servers travels over TLS. Once stored, messages are encrypted at rest with AES-256 using a key specific to your organization.
Can TLS be intercepted?
A correctly configured TLS connection resists eavesdropping and tampering. Risks come from outdated versions, misconfigured servers, users ignoring certificate warnings or devices with untrusted root certificates installed.