Background

Part of data handling and GDPR compliance requirements and best practices

Goal
What questions does this ticket need to answer?

1. What encryption at rest options exist for our DB?
2. How would this impact the various teams' operations?
3. How would that go hand in hand with our current process and operations, e.g., (data anonymization, deletion, etc. )
4. What's the performance/latency impact?
5. How would that change our testing process, if at all?
6. What's the migration path for existing data?
7. Key management approach?

Scope

• Explicitly out of scope: implementation, rollout, code changes
• In scope: research, POC/spike code if needed, cost/performance benchmarks, vendor doc review

Acceptance Criteria

1. A written recommendation covering the recommended approach, tradeoffs, estimated effort, risks, rollback/migration plan.
2. Answers to open questions above

Follow-up tickets created for actual implementation