Thanks @boulos. Appreciate it. I'm unclear on what encrypted at rest means. For example - I'd expect the data in Google cloud store to be encrypted (or have an option to be encrypted) so that if someone were to get access to our DB admin account, they won't be able to see the JSON data in plain text. The only way to see the data would be through API access which can be configured for ACL (and by Google cloud store so we can index and query data which is encrypted at rest).