I am new to the whole encryption thing. I've been reading a lot about it lately but still have some questions. So I am tasked with building a sign on solution on our side that will securely transmit information from our servers to a SaaS.
This information is highly sensitive (not passwords though) and thus why we need to encrypt it. What I am trying to wrap my head around is how I go about sending information about how to decrypt this information to the SaaS. Right now I've got it setup in .net that I encrypt it using AES with a 256b bit key, 128 bit IV, using PKCS7 padding, and the CBC cipher mode. I've read conflicting information on whether or not I should change the key and IV every time or not. If I do change the Key and IV every time how do I securely tell my SaaS about that so that they can decrypt the information? Is there another better practice I should be doing to send this information to the SaaS to be decrypted?