I'm not the OP, but you should know that for security-conscience people the idea of earning trust does not exist. I should never have to trust you, your web dev, your software engineer, your CTO, your devops guy, your cloud provider, your cleaning staff, and your interns. Rather, provide to me a service that is secure even assuming that the aforementioned entities are compromised, then you'll earn my business and my money.

>We have at-rest encryption on our roadmap

i'm not sure whether you understood the term "at-rest", all that would imply is that the data disk (or perhaps the database) is fully encrypted, but the server holds the decryption key at runtime. that would add no security because anyone who hacked into the application server will still be able to dump + decrypt all the notes, all they have to do is also dump the key from the running server. what you need is end-to-end encryption, so the server only receives the encrypted notes from the client.