PII in a separate db. Encrypted like you would a credit card card number. BTW: email+password should be separated too. An early draft of GDPR specifically ment

PII in a separate db. Encrypted like you would a credit card card number. BTW: email+password should be separated too. An early draft of GDPR specifically mentioned that, though the final version got less into the weeds. I’m sure if you vibe code any of this, it will all be plaintext, lol.