AWsS can do server-side encryption of assets like S3 buckets, and you can also set policies that require uploaded content to be encrypted client side. But just

AWsS can do server-side encryption of assets like S3 buckets, and you can also set policies that require uploaded content to be encrypted client side. But just having PII is a huge risk, even if it is encrypted or anonymized. Best not to have PII at all, unless you know how to properly build a digital Fort Knox that you are confident can properly protect that data. Hell, best just not to have PII at all — it’s a huge liability.