Consider in-db encryption of sensitive data

[ruestitch]

sensitive data may be limited to phone and email data

[eugeniojimenes]

Hi! I'd like to work on this. Two scope questions before I start:

1. Looking through the schema, sensitive data goes beyond phone and email, for example: children.date_of_birth and authorized_family_members.date_of_birth (minors), families.guardian_phone, free-text comments fields, and address fields on partners/vendors. Should encryption cover all PII (Personally Identifiable Information) like these, or strictly phone + email for now?

2. On approach: since we're using Rails 8 with pure Active Record, I'd lean on the built-in encrypts (non-deterministic for fields like date of birth, comments, and address, and deterministic only for any field that must stay queryable). Does that sound right?

[dorner]

1. Address won't be PII since it's for organizations, not people. Same with comments - I don't think there's any PII guarantee about that. The others seem like they should be part of this though.

2. Yes, it does!

[eugeniojimenes]

Thanks @dorner! Could you please assign me here?

[eugeniojimenes]

Hi! Can anyone with access to production tell me roughly how many rows are in children / authorized_family_members at prod scale? I'm deciding whether the date_of_birth-encryption backfill goes in the migration (find_each(&:encrypt), which loads each row and can be slow) or a separate batched rake task.

[dorner]

Children has about 21K rows and authorized_family_members has 17K.