A review form asked me a yes/no question I could not answer with yes: do you encrypt personal data at rest and in transit? In transit, sure, TLS everywhere, that part is free in 2026. At rest, no. The app runs on a plain VPS with no full-disk encryption, and the database held customer names, addresses and email addresses in a json column, in clear, exactly as PostgreSQL received them. There are two ways out of that question. One is to click yes and move on, because everybody knows the ...