Decisions
Engineering decisions, with their costs
Every significant decision is recorded the same way: the context, the choice, and — honestly — what it gained and what it gave up. This index grows as decisions are documented.
A decision is not complete until the cost you accepted is written down too.
Application-level PII encryption over database-only encryption
A secure healthcare platform handled highly sensitive personal data under strict privacy and compliance requirements. Database-level encryption alone leaves plaintext exposed to anything with database access.
Encrypt multiple categories of PII at the application layer using X25519 envelope encryption, derive client key-encryption keys with Argon2id, retain decrypted private keys only in volatile browser memory, and use deterministic SHA-256 lookup hashes where encrypted fields must remain searchable. Data access followed the principle of least privilege.
- Defense in depth beyond the database boundary
- Key/data separation via envelope encryption and a stronger key-management posture
- Reduced exposure from persistent client-side key storage through memory-only key retention
- Compliance and auditability posture appropriate to healthcare PII
- Added implementation complexity
- Encrypted fields cannot be queried by normal equality — deterministic SHA-256 lookup hashes were needed, with equality leakage accepted where search was required
- Async intake processing and worker operations added implementation complexity
- Memory-only key retention requires re-authentication after a full page reload or tab close
Security must be part of the architecture from the start — it cannot be bolted on at the end.
Appears in · Privacy-first architecture on a healthcare platform