Encryption in transit (HTTPS/TLS) protects data moving between browser and server. Encryption at rest protects data stored on disk. For law firm sites handling client PII, both are non-negotiable. Store password hashes with bcrypt (never plaintext), encrypt PII at rest, never log secrets.