Amazon Kendra encrypts your data in transit and at rest. You have three choices for encryption keys for data at rest: AWS-owned KMS key, AWS-managed KMS key in your account, or a customer-managed KMS key. For data in transit, Amazon Kendra uses the HTTPS protocol to communicate with your client application. API calls to access Amazon Kendra through the network use Transport Layer Security (TLS) that must be supported by the client.