When building an insurance application, we often store sensitive information such as a driver's date of birth (DOB), driver's license number, phone number, and other personally identifiable information (PII).

But what happens if someone gets access to our database?

Database authentication and access control are important, but they do not necessarily protect data from someone who obtains a database dump or gains unauthorized direct database access.

One way to add another layer of protection is application-level encryption .

In this article, we'll explore how AES-256-GCM works, how encryption keys are managed, and how to implement field-level encryption in a Spring Boot application.

1. The Problem: Storing Sensitive Data in Plaintext

Imagine our insurance application stores driver information in PostgreSQL.

A database record might look like this:

id date_of_birth driver_license

101 2000-05-15 D1234567

The application can read this information directly from the database.…