in our SaaS application we store different integration tokens from apps like Trello, Pivotal, Intercom etc, based on Oauth tokens, which we want to additionally (on top of the default database encryption at rest) symmetrically encrypt and decrypt using best practices. Given the criticality of the tokens (not cardholder data), but still very sensitive authentication tokens, which one of the following approaches would you recommend ?
- Using Encryption as a Service mechanism, which will simply encrypt and decrypt every single payload using a single API call (e.g. Hashicorp Vault, Transit engine), where each customer/space will have it's own master key.
- Using Envelope encryption, where DEK will be stored next to the data in the main database and the KEK will be stored in some KMS (e.g. Vault K/V mode), where each customer/space will have it's own master key and each row (data record/object) will have it's own data encryption key.
The difference between both approaches is that the first one does not include usage of Data Encryption keys and "two way encryption".