Data Security — hobby stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Encryption Platform / KMS
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free self-hosted; HCP Vault $0.03/hr (~$22/mo) + $0.03/10k ops; AWS KMS $1/key/mo + $0.03/10k req + $1/10k asymmetric; CloudHSM $1.88/hr (~$1,373/mo/cluster); GCP KMS $1/key/mo $0.03/10k; Azure KV $0.03/10k ops
Secrets Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free; Infisical OSS Free, Cloud Free 2 envs 5 members; Doppler Free 5 users/200 secrets, Team $10/user/mo, Enterprise $20/user/mo; HCP Vault Dedicated $0.16/hr/cluster (~$117/mo) + storage $0.50/GB; CyberArk $35k/yr
Encryption at Rest - Block Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsLUKS Free; EBS Default Free + $1/key/mo if CMK, $0.03/10k req; Azure Disk Encryption Free platform key, CMK $1/key/mo; Thales CTE $12k/yr per host; NetApp VE $2,500/yr/license
Encryption in Transit - TLS / mTLS
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsLet's Encrypt Free 50 certs/domain/week 90d validity; Cloudflare Free, Pro $20/mo, Business $200/mo; ACM Public Free, Private CA $400/mo/CA + $0.75/cert issued; Istio mTLS Free OSS; Smallstep Professional $340/mo
Backup Encryption
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsRestic Free OSS; S3 SSE-S3 Free, SSE-KMS $1/key/mo + $0.03/10k; AWS Backup $0.05/GB-mo warm, $0.01/GB-mo cold; Druva $60/TB/mo; Cohesity $0.15/GB/mo; Veeam $1,200/socket/yr + $300/instance
Audit Logs WORM / Immutable Logging
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsS3 Object Lock Free + $0.023/GB-mo Standard, Glacier $0.0036/GB; CloudTrail Lake $2.50/GB ingested $0.023/GB-mo storage 7yr retention; Azure Immutable $0.02/GB-mo; Splunk Cloud $135/GB/day ingest ~$1,500/mo for 10GB; MinIO Free
Certificate Management / PKI
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitscert-manager Free; Smallstep OSS Free, Professional $340/mo starter, Enterprise $1,500/mo; ACM Public Free, Private CA $400/mo/CA + $0.75/cert; Venafi $50k/yr starting $12k for 500 certs; DigiCert $300/yr OV per cert
Object Storage Encryption (SSE-S3 / SSE-KMS / SSE-C)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsS3 SSE-S3 Free, SSE-KMS $1/key/mo + $0.03/10k encrypt + $0.01/10k decrypt; R2 Default Free; MinIO KES Free OSS; IBM KP $1/key/mo $0.03/10k; Wasabi $6.99/TB/mo includes SSE
Client-Side Encryption Library
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTink Free Apache 2.0; libsodium Free ISC; SOPS Free OSS; AWS Encryption SDK Free (KMS costs); Voltage $75k/yr minimum; Baffle $60k/yr; Virtru SDK $25k/yr
Key Rotation & Lifecycle Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free rotation; AWS KMS annual auto-rotation Free, on-demand rotation Free (pay $1/key/mo); Azure Auto-rotation Free; GCP Rotation Free; CyberArk $35k/yr; Thales CM $18k/yr
Database Transparent Data Encryption (TDE)
Persistent storage for your app’s data — users, products, orders. The single most important architectural decision for most projects.Pricing & free-tier limitsRDS Encryption Free (KMS $1/key/mo); Azure SQL TDE Free platform, BYOK $1/key/mo; Oracle TDE $11,500/processor + 22% support; SQL Server Enterprise $13,748/core (2-core pack) for TDE + Always Encrypted; Vormetric $10k/yr/host
How this hobby data security checklist works.
Each requirement below is something a hobby data security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.