We have a web application (running in Apache Tomcat on a Windows Server 2008 machine) that stores most of its data in the file system. We are investigating ways to implement encryption for this data at rest. For our use-case, there is just a single folder that we would want to encrypt such that it can only be read/modified by the tomcat service user account. That single folder is currently around 20GB and is read-from and written-to by the application constantly.
Our first thought was to use Windows EFS, but this proved to be problematic. For reasons we have not been able to discover, a few hundred thousand files that we tried to encrypt were permanently corrupted. It seemed at though they were still encrypted, but the OS thought they were just garbled plain text files and did not give us the option to decrypt them. Since we were not able to identify the cause of this, we are uncomfortable relying on EFS.
The other alternatives we've been able to identify (so far VeraCrypt and Symantec File Encryption), though, all assume that there will be a physical user at the other end of the encryption who will be able to enter a passphrase to unlock the files. This won't work for a service account that will not login. Our application would lose access to the files any time the server restarts.
I can't imagine others haven't had a similar situation, but we're having a hard time identifying viable alternatives. Are there any recommended solutions for this type of use case?