Encrypted 7-zip with an encrypted keypass file inside, stored on highly audited and logged PCI server. Certainly not in a cloud service, as that puts the creds

Encrypted 7-zip with an encrypted keypass file inside, stored on highly audited and logged PCI server. Certainly not in a cloud service, as that puts the creds in a 3rd party data processor. Creds rotated as people move around.