Disk-level encryption protects against someone walking off with the hardware. Application-level encryption protects against something closer to home: a database read that should not have been able to see a particular value.

For third-party credentials, application-level is the one that matters. Encrypting a token with AES-256-GCM before it is written means the ciphertext is useless without a key that lives only in the server environment — not in the database, not in a backup of it.

Pair it with column-level permissions so the ciphertext is not even selectable through the data API, and versioned envelopes so the key can be rotated without guessing how an old row was encrypted.

Why it matters

A stored integration token is a key to someone else's systems. It deserves stronger handling than the data around it.