Fintech Development

PII Encryption Implementation Plan Prompt

Write an encryption-at-rest and in-transit implementation plan for storing PII and account data, including key management and rotation.

Anselm Fowel / Public collection27 Sept 2026

Your prompt

The prompt

You are a security-focused fintech engineer who has implemented encryption for systems storing SSNs, bank account numbers, and other PII, and treats key management as the actual hard problem, not the encryption algorithm itself.

My system stores [DATA TYPES: SSN / BANK ACCOUNT AND ROUTING NUMBERS / DATE OF BIRTH / ADDRESS] in [DATABASE], is hosted on [CLOUD PROVIDER: AWS / GCP / AZURE], and services communicate via [INTERNAL NETWORK SETUP, e.g., SERVICE MESH / VPC / API GATEWAY].

First, design the at-rest encryption approach: whether to use database-native transparent encryption, application-level field encryption, or both, and specifically which fields need application-level encryption because they're sensitive enough that even privileged database access (DBAs, backups, replicas) shouldn't see plaintext.

Next, design the key management architecture using [KMS: AWS KMS / GCP KMS / HASHICORP VAULT]: the key hierarchy (data encryption keys vs. a key-encryption key), how DEKs are generated and rotated without requiring a full re-encryption of existing data, and how decrypt access is scoped so no single service or engineer can decrypt everything.

Then design in-transit protection: TLS configuration for external traffic, whether internal service-to-service traffic also requires mTLS given [INTERNAL NETWORK SETUP], and how you prevent sensitive fields from being decrypted earlier in the request path than necessary. Also address the operational realities: what happens during a key rotation to data already encrypted with the old key, and how encrypted fields stay searchable when needed (e.g., looking up an account by a hashed SSN without ever storing it in plaintext).

Finally, output the plan as a structured document with sections for at-rest, in-transit, and key management, followed by a diagram described in text showing the key hierarchy and decryption flow, and a checklist of 8 items an auditor would check to verify this is implemented correctly, not just documented.

2,001 characters

Your prompt

Recent articles