Isolation versus encryption
A private DC-to-DC circuit separates your traffic from other customers and from the public internet. But isolation is not the same as confidentiality. If someone could tap the fibre, unencrypted traffic would be readable.
When encryption is expected
Financial services, healthcare and government workloads often carry an explicit requirement to encrypt data in transit, regardless of the path. Internal security policies may require it too.
Option 1: MACsec
MACsec encrypts traffic at layer 2, between two directly connected devices. On hardware that supports it, it runs at line rate with negligible latency, making it ideal for high-throughput links between data centers.
Option 2: IPsec
IPsec works at layer 3 and is supported almost everywhere. It is flexible but can be limited by the throughput of the encrypting devices, so size them carefully for high-bandwidth links.
Option 3: Encrypt in the application
TLS between application components protects data end to end, independent of the network. Many modern systems already do this, and it may satisfy your requirements without network-level encryption.
Choosing
Combine options based on risk and requirements. A common pattern is MACsec on high-capacity DC links plus TLS for sensitive application traffic.
Peer1IX can provision DC-to-DC circuits compatible with your encryption design. Ask our engineers.
