If you have the operational manpower, Vault is a good solution as well. With Vault you can create an endpoint that will encrypt/decrypt data with a key that onl

If you have the operational manpower, Vault is a good solution as well. With Vault you can create an endpoint that will encrypt/decrypt data with a key that only Vault knows. You can have a unique endpoint for each user. Then in your application when the user submits some data, you ask Vault to encrypt it before you store it in your main data store. When you need to read it, you get that value from your store and ask Vault to decrypt it. If you have different services doing the reading/writing you can even setup your permissions so that one service can only decrypt and the other can only encrypt.