Why should you care?

Stolen hard drives and insider access are real. Healthcare and fintech regulations often mandate encryption at rest and strict field controls.

See it live — copy this example

Open mongosh or MongoDB Compass, select database nosqlverse, then run the example. Change one field and run again.

// Atlas: enable Encryption at Rest with your KMS (UI)
// Field-level idea with client-side encrypting fields before write (simplified concept):
db.users.insertOne({
  email: "pat@hospital.in",
  // In real CSFLE/QE, ssn is encrypted binary ciphertext:
  ssn_encrypted: BinData(6, "AQID...") 
})
db.users.find({ email: "pat@hospital.in" }, { ssn_encrypted: 0 })

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• At-rest encryption is usually toggled in Atlas/KMS.
• Highly sensitive fields can be stored as ciphertext.
• Apps decrypt with keys the database never sees in cleartext for client-side encryption schemes.

Practice next

1. On Atlas, review Encryption at Rest settings.
2. Classify fields: public, internal, sensitive.
3. Plan CSFLE/QE for the sensitive set (later lesson).
4. Document which fields need field-level encryption in your app.
5. Enable backup encryption options in Atlas.

Remember

Encrypt in transit (TLS) and at rest. Field encryption protects sensitive columns. Key management is half the design.

Aadhaar-like identifier storage

A KYC system stores government IDs encrypted at field level.

Outcome: DBA disk access cannot read raw identity numbers.