If your system needs both to encrypt and decrypt some information this to me means that the decryption key has to be stored somewhere and if that somewhere is c

If your system needs both to encrypt and decrypt some information this to me means that the decryption key has to be stored somewhere and if that somewhere is compromised, so is everything else. I would store the decryption key on the filesystem somewhere obscure, so that if somebody gets into your database, but not the filesystem, the data still remains encrypted. If your filesystem is compromised, all your security measures will quickly become meaningless. You will need to do continuous security monitoring and auditing to make sure that doesn't happen.