At your stage, keeping data that you'd like to encrypt separated from data that you surely won't encrypt is probably be the fastest solution. It will be easy to

At your stage, keeping data that you'd like to encrypt separated from data that you surely won't encrypt is probably be the fastest solution. It will be easy to encrypt it later, when time comes. Encryption at rest protects from personnel misbehaving. If you use a cloud provider, it's their employees. Similarly, encrypting data at application (backend) layer and storing encrypted blobs in the database, protects from your dbas/employees misbehaving, for example me taking a look at my friend's notes. For encryption to be useful, as you pointed out, it's not enough to encrypt. You need to store your key(s) in a secure place, and release them only to production machines. You need to be able to rotate keys. You need access logs for auditing. And you probably want a development environment that uses different keys than production. In short, you need a KMS, a way to authenticate machines, a protocol to rotate keys, logs & alerts, etc.