I have a project that requires users to submit a photo of a driver's license as proof of identity. This image just needs to be seen once by an administrator, and has no use after their id is verified.

This project uses AWS to store data. Data sent to AWS can be encrypted at their level, but I feel like application level encryption could still be useful as well.

But then....if I have my secret key stored in the app as an ENV variable, it's kinda self defeating, isn't it? Is there a better way of doing this? Considering the fact that an admin needs to verify the id, is encryption needed?

1 Answer 1


In general make two or more encryption operations on the same item(encrypt the same file two times) is a bad idea and is not necessary (check https://crypto.stackexchange.com/), but encrypt confidential information such the images you mention is for example mandatory in Europe due to the GDPR. If the storage of AWS(or other vendor) offers the service of encryption then is enough on a first stage, however, depending on your application may be a good idea to encrypt on the source but this depends on how is your application build. Just keep in mind that any information that can identify a user or the information is critical needs to be encrypted in some way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .