Encryption at rest

Encryption at rest protects stored data — database files, backups, uploads — so that obtaining the storage does not yield the contents. It is the counterpart to encryption in transit, which TLS provides.

Its scope is narrower than it sounds. Full-disk encryption defends against a stolen or improperly disposed-of disk; it defends against nothing at all while the machine is running and the application is authenticated, which is the situation in every realistic breach.

The stronger form is encrypting specific sensitive fields in the application, with keys held outside the database. Then a leaked database dump is not a disclosure. It costs the ability to search or index those fields, which is why it is applied selectively rather than everywhere.