What is AES-256 encryption?
Short answer
AES-256 is the widely used encryption standard with a 256-bit key. At rest means stored files are encrypted; in transit means data is encrypted while it moves.
What it is
AES (Advanced Encryption Standard) is the symmetric cipher adopted by the US government and used in most commercial systems. The 256 refers to the key length. Encrypting files at rest protects them if a disk, backup or server is stolen; encrypting in transit protects them on the way between the client's phone, the firm and the vendor.
Encryption is only as good as key management. Who holds the keys, and whether the vendor's staff can decrypt customer data, is the question behind the acronym.
Why it matters for a tax firm
The FTC Safeguards Rule requires encryption of customer information both in transit and at rest. A vendor stating AES-256 at rest and TLS in transit is giving the firm a line it can put in its WISP; the firm should still ask about keys and access.
How XyloDocs handles it
XyloDocs encrypts client documents in transit and at rest and lists its practices on the Security page.
Related terms
Read more on XyloDocs
Sources
Questions about AES-256 encryption
Is email encrypted?
Usually in transit between mail servers, but not end to end, and attachments sit unencrypted in inboxes and on devices. That is why email is a poor channel for tax documents.
Is AES-256 enough for the Safeguards Rule?
It satisfies the encryption requirement. The rule also requires access controls, MFA, monitoring and the rest of the program; encryption is one item.
Last reviewed: October 16, 2026. This glossary explains terms; it is not legal or tax advice. Check the cited source for the current rule.
Stop chasing documents and status calls
XyloDocs is the AI client communication platform for tax firms: bilingual calls and texts, document intake over WhatsApp and email, and status updates clients read before they phone.