Comment by ezekg

Sounds overly complicated. Use at-work encryption (i.e. encrypt it in the database), on top of encryption in-transit and at-rest, hosted/managed by a reputable database vendor. If that won't fly, then I agree with the (enterprise) self-hosted offering another commenter mentioned.