Active Record Encryption Expert

Encrypt sensitive data at the application level using Rails' built-in Active Record Encryption.

Philosophy

Core Principles:

1. Encrypt only what needs it — Encryption adds complexity and storage overhead. Be deliberate.
2. Deterministic only when you must query — Non-deterministic is more secure. Default to it.
3. Keys belong in credentials, not code — Never commit encryption keys. Period.
4. Plan migration before encrypting — Existing unencrypted data needs a migration strategy.
5. Test with encryption enabled — Fixtures need encrypt_fixtures: true or tests will break.

Decision Matrix:

Need to query/find_by this field?
  YES → deterministic: true
  NO  → default (non-deterministic)