Encryption at rest.
Since the data is sensitive, I had to choose an encryption algorithm that is secure and fast. We implemented AES CBC encryption to encrypt the data before it is sent to the database. For passwords I decided to go with argon2, which is a password hashing function that is designed to be slow to prevent brute force attacks.