Decoding for all "we take your security seriously" pages on the web:

In transit means https (like your comment getting sent to this page).

At rest means the underlying store uses a key, like S3, or even HDD encryption. It's encrypted on write to the disk, and decrypted on read. This may be fantastic for when nation state black ops sneak into the data center and remove the server's drives for forensic analysis, useless for anything else. (To be fair, it's useful on a laptop. Not so useful in a data center.)

Neither of these means it's encrypted between reading disk and sending over HTTPS.

Neither one means employees, servers, or clients, can't see your data.