I've developed a website where people add their sensitive data. Not credit cards, but lets say they share things about themselves which are private and it wouldn't be good if other people see that info. Some of the data is private, some is public.
I want to keep the private data private as in... If someone breaks into the server I want them to be able to extract encrypted versions, rather than plane text about my users' accounts.
What I've thought about so far is the following. 1. SSL certificate (doesn't really protect the data on the server, but the connection) 2. the data which is market private to be encrypted by a series of algorithms (I would imagine that would be heavy on the server) 3. encrypt the php functions which encodes/decodes the data.
I'm not very well prepared for this tho, so I would like to know what is considered best practice for my situation? Am I overcomplicating the process?
The thing is that the app is not generating any income so I can't afford a sys admin, nor I'm able to look after the traffic 24/7. I'm looking for a solution which will take care on its own. Also I can't spend $$$ on sophisticated software that would do the job. I'm looking to bootstrap the app as much as possible. I can afford the SSL cert but not a 600$ Zend Guard for instance.
PS. I've used codeigniter so far to write my php code if that matters.