Security: Add Database Column-Level Encryption for PII Data

[Smartdevs17]

Context

PII data (email, phone, address, bank account info) stored in plaintext in the database is vulnerable to data breaches.

Current Limitation/Problem

Sensitive merchant and user data is stored in plaintext columns. A database breach exposes all PII. Current encryption is at-rest only (disk level).

Expected Outcome

Column-level AES-256-GCM encryption for PII fields with separate encryption keys per tenant, key rotation, and minimal performance impact.

Acceptance Criteria

• Identify PII columns: email, phone, address, bank_account, tax_id, ip_address
• Implement transparent encryption/decryption at the Prisma middleware layer
• AES-256-GCM with random IV per value
• Tenant-specific encryption keys (envelope encryption with master key)
• Key rotation with re-encryption support
• Searchable encrypted fields via deterministic encryption for exact matches (email lookup)
• Performance: encryption adds <5ms per operation
• Audit log for all decryption operations
• Compliance: GDPR, CCPA, SOC2 readiness

Technical Scope

• backend/src/encryption/ - encryption service
• backend/src/encryption/column-encryptor.ts - transparent encrypt/decrypt
• Prisma middleware for automatic encryption/decryption
• AWS KMS or HashiCorp Vault for master key management
• Prisma: @@encrypted schema extensions
• Edge cases: encrypted column search, key rotation during transactions, backup decryption

[Vicsygold]

@Vicsygold has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Maintainer, Please can I have this project I will resolve it immediately. Thanks in advance!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Vicsygold to this issue.

[vjuliaife]

@vjuliaife has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi, i would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @vjuliaife to this issue.

[drips-wave]

Congratulations, @vjuliaife! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @vjuliaife: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊