Enable encryption at rest

Most managed database services enable this by default:

# Check encryption status for various platforms:

# PostgreSQL (RDS) - enabled by default with AWS KMS
# Verify in AWS Console → RDS → Database → Configuration

# MongoDB Atlas - enabled by default
# Verify in Atlas → Security → Encryption at Rest

# Supabase - enabled by default with AES-256
# No action needed

# Self-hosted PostgreSQL - enable in postgresql.conf
# Requires pgcrypto extension or disk-level encryption

For self-hosted databases, consider full-disk encryption (LUKS on Linux, BitLocker on Windows) or Transparent Data Encryption (TDE) if your database supports it.

Enable encryption in transit (TLS/SSL)

Always use encrypted connections to your database:

// PostgreSQL connection with SSL
const connectionString =
  'postgresql://user:pass@host:5432/db?sslmode=require';

// MongoDB with TLS
const mongoUri =
  'mongodb+srv://user:pass@cluster.mongodb.net/db?tls=true';

// MySQL with SSL
const mysqlConfig = {
  host: 'your-host.com',
  user: 'user',
  password: 'pass',
  database: 'db',
  ssl: {
    rejectUnauthorized: true
  }
};

SSL modes for PostgreSQL:

• disable - No SSL (never use in production)
• require - Encrypt connection, don't verify certificate
• verify-ca - Verify server certificate is signed by trusted CA
• verify-full - Verify certificate and hostname match (most secure)

Implement application-level encryption

Encrypt sensitive data before storing it:

// Node.js with built-in crypto
import crypto from 'crypto';

const ALGORITHM = 'aes-256-gcm';
const KEY = Buffer.from(process.env.ENCRYPTION_KEY, 'hex'); // 32 bytes

function encrypt(text) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv(ALGORITHM, KEY, iv);

  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');

  const authTag = cipher.getAuthTag().toString('hex');

  // Return IV + authTag + encrypted data
  return iv.toString('hex') + ':' + authTag + ':' + encrypted;
}

function decrypt(encryptedData) {
  const [ivHex, authTagHex, encrypted] = encryptedData.split(':');

  const iv = Buffer.from(ivHex, 'hex');
  const authTag = Buffer.from(authTagHex, 'hex');
  const decipher = crypto.createDecipheriv(ALGORITHM, KEY, iv);

  decipher.setAuthTag(authTag);

  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');

  return decrypted;
}

// Usage
const ssn = '123-45-6789';
const encryptedSSN = encrypt(ssn);
// Store encryptedSSN in database

const decryptedSSN = decrypt(encryptedSSN);
// Returns: '123-45-6789'

Use a key management service

Don't hardcode encryption keys - use a KMS:

// AWS KMS example
import { KMSClient, EncryptCommand, DecryptCommand } from "@aws-sdk/client-kms";

const kms = new KMSClient({ region: "us-east-1" });
const KEY_ID = process.env.KMS_KEY_ID;

async function encryptWithKMS(plaintext) {
  const command = new EncryptCommand({
    KeyId: KEY_ID,
    Plaintext: Buffer.from(plaintext)
  });

  const response = await kms.send(command);
  return Buffer.from(response.CiphertextBlob).toString('base64');
}

async function decryptWithKMS(ciphertext) {
  const command = new DecryptCommand({
    CiphertextBlob: Buffer.from(ciphertext, 'base64')
  });

  const response = await kms.send(command);
  return Buffer.from(response.Plaintext).toString('utf8');
}

Encrypt specific fields in your models

Create a pattern for handling encrypted fields:

// Prisma middleware example
import { PrismaClient } from '@prisma/client';

const prisma = new PrismaClient();
const SENSITIVE_FIELDS = ['ssn', 'taxId', 'bankAccount'];

// Encrypt on write
prisma.$use(async (params, next) => {
  if (['create', 'update'].includes(params.action)) {
    for (const field of SENSITIVE_FIELDS) {
      if (params.args.data?.[field]) {
        params.args.data[field] = encrypt(params.args.data[field]);
      }
    }
  }
  return next(params);
});

// Decrypt on read
prisma.$use(async (params, next) => {
  const result = await next(params);

  if (result && typeof result === 'object') {
    for (const field of SENSITIVE_FIELDS) {
      if (result[field]) {
        result[field] = decrypt(result[field]);
      }
    }
  }
  return result;
});

Handle encryption key rotation

Plan for key rotation from the start:

// Store key version with encrypted data
function encryptWithVersion(text, keyVersion = 'v1') {
  const key = getKeyByVersion(keyVersion);
  const encrypted = encrypt(text, key);
  return `${keyVersion}:${encrypted}`;
}

function decryptWithVersion(data) {
  const [version, encrypted] = data.split(':', 1);
  const key = getKeyByVersion(version);
  return decrypt(encrypted, key);
}

// Re-encrypt data with new key
async function rotateEncryption(records) {
  for (const record of records) {
    const decrypted = decryptWithVersion(record.sensitiveField);
    record.sensitiveField = encryptWithVersion(decrypted, 'v2');
    await record.save();
  }
}