A municipal integration ships tenant inventory and limited PII to a partner webhook. The database volume is encrypted. Which transmission practice is still required?

Personal or tenant data in transit needs authenticated, encrypted transport—not cleartext HTTP—even when disks are encrypted at rest. Warehouse encryption does not protect payloads crossing the network toward partners or other municipal services where observers may sit on the path. Sending over plain HTTP because disk encryption “already satisfied privacy” ignores on-path observers and unmanaged segments between systems. Emailing CSV exports of PII to a partner as the primary interface scatters sensitive copies through mail systems without strong transport or durable access guarantees. Posting to an unauthenticated webhook URL and relying on obscurity of the path fails both authentication and confidentiality as soon as the URL leaks into logs or tickets. Exam caveat: TLS alone is insufficient if clients skip certificate validation or if mutual authentication is required by the threat model and then omitted for convenience. Operational check: capture traffic on a lab path that carries tenant or personal attributes and confirm the payload is encrypted; verify the client rejects invalid certificates rather than falling back to cleartext. Record the outcome in the release or incident notes so the next operator inherits evidence, not tribal knowledge.