I’d say it depends on the data being persisted. PII or any user data that is private in nature are good candidates for encryption regardless of session length.

I’d say it depends on the data being persisted. PII or any user data that is private in nature are good candidates for encryption regardless of session length. Other than that encryption is overkill.