> Or do you store an encrypted value in the table that you then decrypt on demand? Is the decryption performed by a microservice that add an additional layer th

> Or do you store an encrypted value in the table that you then decrypt on demand? Is the decryption performed by a microservice that add an additional layer that would need to be hacked? That is precisely one model. In fact, there are hardened "vault" appliances designed for exactly this class of use cases. All sensitive PII is 1) encrypted on the vault and 2) replaced externally with a random token. Most of the time, the rule is that the plaintext PII is never removed from the vault. E.g. to compare a value, a new one is sent to the vault to (idempotently) to retrieve a token. Done right, this gives you other features/requirements such as the ability to rate limit and set alarms on vault accesses. E.g. if someone were trying to brute-force retrieve vault data via token retrieval.