Skip to content
WebDirect
Article 32(1)(a)Article 34(3)

Database Encryption at Rest

Implement transparent database encryption (TDE) with customer-managed keys (CMK) on AWS KMS or GCP Cloud KMS. Reduces Article 34 notification obligations in case of breach.

€1,100–€1,800
EUR
24–40
hours
10–14
business days
Fixed scopeEU-nativeNDA pre-signed
💡Quick Answer

Implement transparent database encryption (TDE) with customer-managed keys for your PostgreSQL, MySQL, or MongoDB cluster on AWS or GCP. Enables Article 34(3) breach notification exemption when encryption is properly implemented. Delivered in 10–14 business days. Fixed price €1,100–1,800 per cluster.

📋Why this service exists

Article 32(1)(a) requires encryption of personal data. Crucially, Article 34(3)(a) exempts organizations from mandatory data subject breach notification if encrypted data is breached — because encrypted data is not 'intelligible' to unauthorized parties. Proper encryption is both a compliance requirement and a liability shield.

Article 32(1)(a)Article 34(3)

What you get

  • Encryption implemented on target cluster (AWS or GCP)
  • Customer-managed key (CMK) configured in KMS
  • Key rotation policy set (90-day automatic rotation)
  • Encryption verification test report
  • Rollback procedure documented
  • Operations runbook for DBA/DevOps team

How we deliver

  1. Day 0
    You request quote → reply in 4 business hours
  2. Day 1–2
    Discovery call & scope clarification
  3. Day 3–5
    Contract signed, kickoff scheduled
  4. Day 5–7
    Implementation begins
  5. Day N
    Final deliverables + walkthrough call
  6. +30 days
    Free post-delivery support

Tools & technologies

AWS KMSGCP Cloud KMSPostgreSQL pgcryptoMySQL TDELUKS

Prerequisites

  • AWS or GCP account with admin access during setup
  • Maintenance window of 2–4 hours (planned downtime may be needed)
  • Backup verified before encryption is applied

Pricing

Base scope€1,100–€1,800
Estimated hours24–40h
Hourly rate€45/h
Delivery time10–14 business days

✓ Within scope:

  • •Single PostgreSQL/MySQL/MongoDB cluster
  • •AWS KMS or GCP Cloud KMS
  • •Standard CMK setup with rotation

⚠ Outside scope (additional quote required):

  • •Multiple clusters (additional quote per cluster +50%)
  • •Custom HSM hardware
  • •On-premises clusters without cloud KMS access

📋Final price confirmed in proposal within 4 hours of your request.

Realistic timeline — what to expect

  1. T+0hSubmit request
  2. T+4hInitial proposal (business hours)
  3. T+1–3dDiscovery call
  4. T+2–3dFinal invoice
  5. T+3–5dContract signed
  6. T+4–6dPayment received
  7. T+5–7dService kickoff
  8. T+5–7d+NService complete
This timeline reflects EU B2B best practices. We protect both parties from misunderstandings.

Frequently asked questions

Will encryption affect database performance?
Modern TDE adds <2% CPU overhead. On AWS RDS and GCP Cloud SQL, encryption is handled at the storage layer with negligible performance impact on standard workloads.
What is a customer-managed key vs. a provider-managed key?
Provider-managed keys (default) mean your cloud provider controls the key. Customer-managed keys (CMK) give you full control — you can revoke access, rotate on your schedule, and prove to auditors that you hold the keys. GDPR and ISO 27001 auditors prefer CMK for sensitive data.
Does this cover backups too?
Yes — we configure encryption at the storage level, which covers the database itself and its automated backups. For offsite backups to S3/GCS, we configure separate encryption (covered in the backup architecture service if needed).

Related services

🔐

TLS Modernization (Encryption in Transit)

Upgrade all services to TLS 1.3, disable weak cipher suites, implement HSTS, and configure certificate auto-renewal. Eliminates man-in-the-middle attack vectors for PII in transit.

€720–1,500
🔐

Field-Level Encryption for Special Category Data

Encrypt specific database fields (medical records, biometrics, financial data) with per-field or per-user keys — beyond standard disk encryption.

€1,800–3,600
🔐

Secrets Management Implementation (HashiCorp Vault)

Replace hardcoded credentials, .env files, and plaintext secrets with HashiCorp Vault or AWS Secrets Manager. Dynamic secrets, automatic rotation, full audit trail.

€1,800–3,600

Request a quote

You're requesting a quote for:

Database Encryption at Rest

Estimated: €1,100–1,800 · 10–14 business days

Initial proposal within 4 business hours, contract within 3 business days.

Where we'll send your proposal and invoice.

If you prefer to discuss by call.

🔒 Your data is encrypted in transit and at rest. Never shared with third parties.

⏱ Initial proposal within 4 business hours (EU hours, Mon–Fri 9:00–18:00 EET).

💼 Mutual NDA available on request before any sensitive discussion.