In SAP Cloud Integration, securing message exchange is implemented at two distinct levels. Transport-level security protects the communication channel between endpoints, typically using protocols like TLS/SSL to encrypt the entire data stream in transit. This ensures confidentiality and integrity for the connection itself. Message-level security applies protection directly to the message payload, independent of the transport protocol. This involves encrypting and/or digitally signing the message content, for example, using PGP or WS-Security standards. This provides end-to-end security, ensuring the message remains protected even when passing through intermediate systems.

A. Deployment: Deployment is a phase in the integration artifact lifecycle where the iFlow is placed on the runtime node. It is not a level of securing the actual message exchange.

B. Runtime: Runtime is the environment where the integration flow executes. While security is applied at runtime, "Transport" and "Message" are the specific, technical levels of security, making "Runtime" too general.

1. SAP Help Portal

SAP Integration Suite > Security > Security Concepts > Transport-Level Security: "SAP Cloud Integration supports security on two levels: on transport level and on message level. Transport-level security means that the connection used to transport a message between the involved systems is secured." This section details the use of TLS for securing the channel.

2. SAP Help Portal

SAP Integration Suite > Security > Security Concepts > Message-Level Security: "Message-level security means that the message content itself is secured (by encrypting and/or signing it). This option provides end-to-end security for a message." This section describes using digital signatures and encryption (like PGP) on the payload.

3. SAP Help Portal

SAP Integration Suite > Security > Security Features > PGP Encryption and Decryption: "You can use Pretty Good Privacy (PGP) to secure messages at message level." This document explicitly categorizes PGP as a message-level security feature

reinforcing the distinction from transport-level.