My question is how Salesforce encrypted data when it travels to an external system? or are not encrypted? I know that Salesforce use TLS between browser and Salesforce server, but what happen with the data that travels to another system? Thanks.
For email, you can configure TLS settings (required, preferred, or disabled). For Outbound Messaging, TLS is required. For SOAP and REST calls, developers must explicitly disable TLS for the connection in the Remote Site Settings. In other words, except for email, most data is automatically encrypted during transfers, unless disabled intentionally. It is up to the third party to secure the data after transfer.