Database TDE or column-level encryption for sensitive fields

CWE-311 and CWE-312 describe the same failure at two layers: storing sensitive data without encryption (CWE-311) and storing passwords or credentials in a recoverable format (CWE-312). When neither TDE nor column-level encryption is present, every backup file, DB replica, and read replica contains plaintext cardholder data. PCI-DSS 4.0 Req-3.4 requires protection of stored cardholder data; NIST SC-28 requires protecting the confidentiality of data at rest. A breach that dumps the database — via SQL injection, misconfigured IAM, or insider access — becomes a full cardholder data exposure with no additional attacker steps. OWASP 2021 A02 (Cryptographic Failures) specifically calls out missing database encryption as a root cause.

Enable TDE at the cloud provider level first (it covers every table automatically), then add application-level column encryption for the highest-sensitivity fields. In Prisma, annotate encrypted columns so they're never queried or returned raw:

// prisma/schema.prisma — document encryption expectations in comments
model Account {
  id         String @id @default(cuid())
  // Encrypted with AES-256-GCM before insert; decrypted on read in AccountService
  cardToken  String @db.Text
  // Encrypted with AES-256-GCM; never selected in list queries
  ssn        String? @db.Text
  balance    Decimal @db.Decimal(15, 2)
}

For PostgreSQL, enable encryption at rest in AWS RDS by checking "Enable encryption" when creating the instance, or use pgcrypto for column-level encryption on an existing unencrypted instance.