To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe.
As far as I know (see also this question) these details can not be used to withdraw money without verification (Direct Debit in Germany?).
Would you encrypt these details? Or in other words, is it considered good practice to especially protect them? (Like you won't store passwords in cleartext but rather as a hash)