Encryption is table stakes, so the honest answer is short: yes, in transit and at rest, with managed keys, on infrastructure that inherits its provider's physical and network security.
The protections that distinguish Heidi sit above encryption: per-fact permissions, tenant isolation, scoped tokens, and receipts on every action. Encryption keeps outsiders out; those keep insiders and agents honest.