Agent WranglersPersonal data Recommended
Encrypt the most sensitive fields
Encrypt fields whose leak would cause serious harm, such as ID numbers or health data, in the app before they reach the database.
How to do it
Encrypt with a well-known library and a key held in a secret store, not in the database. Store a keyed hash next to it if you must search by the value. Disk encryption does not protect against someone who can query the database.
How to check
Query a sensitive column directly in the database. It shows unreadable ciphertext.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers data playbook: https://agentwranglers.se/playbook/data/personal-data/field-encryption.