Data Security — professional stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Encryption Platform / KMS
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free self-hosted; HCP Vault $0.03/hr (~$22/mo) + $0.03/10k ops; AWS KMS $1/key/mo + $0.03/10k req + $1/10k asymmetric; CloudHSM $1.88/hr (~$1,373/mo/cluster); GCP KMS $1/key/mo $0.03/10k; Azure KV $0.03/10k ops
Secrets Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free; Infisical OSS Free, Cloud Free 2 envs 5 members; Doppler Free 5 users/200 secrets, Team $10/user/mo, Enterprise $20/user/mo; HCP Vault Dedicated $0.16/hr/cluster (~$117/mo) + storage $0.50/GB; CyberArk $35k/yr
Encryption at Rest - Block Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsLUKS Free; EBS Default Free + $1/key/mo if CMK, $0.03/10k req; Azure Disk Encryption Free platform key, CMK $1/key/mo; Thales CTE $12k/yr per host; NetApp VE $2,500/yr/license
Encryption in Transit - TLS / mTLS
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsLet's Encrypt Free 50 certs/domain/week 90d validity; Cloudflare Free, Pro $20/mo, Business $200/mo; ACM Public Free, Private CA $400/mo/CA + $0.75/cert issued; Istio mTLS Free OSS; Smallstep Professional $340/mo
Backup Encryption
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsRestic Free OSS; S3 SSE-S3 Free, SSE-KMS $1/key/mo + $0.03/10k; AWS Backup $0.05/GB-mo warm, $0.01/GB-mo cold; Druva $60/TB/mo; Cohesity $0.15/GB/mo; Veeam $1,200/socket/yr + $300/instance
Audit Logs WORM / Immutable Logging
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsS3 Object Lock Free + $0.023/GB-mo Standard, Glacier $0.0036/GB; CloudTrail Lake $2.50/GB ingested $0.023/GB-mo storage 7yr retention; Azure Immutable $0.02/GB-mo; Splunk Cloud $135/GB/day ingest ~$1,500/mo for 10GB; MinIO Free
Certificate Management / PKI
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitscert-manager Free; Smallstep OSS Free, Professional $340/mo starter, Enterprise $1,500/mo; ACM Public Free, Private CA $400/mo/CA + $0.75/cert; Venafi $50k/yr starting $12k for 500 certs; DigiCert $300/yr OV per cert
Object Storage Encryption (SSE-S3 / SSE-KMS / SSE-C)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsS3 SSE-S3 Free, SSE-KMS $1/key/mo + $0.03/10k encrypt + $0.01/10k decrypt; R2 Default Free; MinIO KES Free OSS; IBM KP $1/key/mo $0.03/10k; Wasabi $6.99/TB/mo includes SSE
Client-Side Encryption Library
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTink Free Apache 2.0; libsodium Free ISC; SOPS Free OSS; AWS Encryption SDK Free (KMS costs); Voltage $75k/yr minimum; Baffle $60k/yr; Virtru SDK $25k/yr
Key Rotation & Lifecycle Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free rotation; AWS KMS annual auto-rotation Free, on-demand rotation Free (pay $1/key/mo); Azure Auto-rotation Free; GCP Rotation Free; CyberArk $35k/yr; Thales CM $18k/yr
Database Transparent Data Encryption (TDE)
Persistent storage for your app’s data — users, products, orders. The single most important architectural decision for most projects.Pricing & free-tier limitsRDS Encryption Free (KMS $1/key/mo); Azure SQL TDE Free platform, BYOK $1/key/mo; Oracle TDE $11,500/processor + 22% support; SQL Server Enterprise $13,748/core (2-core pack) for TDE + Always Encrypted; Vormetric $10k/yr/host
Hardware Security Module (HSM) / CloudHSM
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSoftHSM Free; YubiHSM 2 $650 one-time + $0 free/mo; CloudHSM $1.88/hr per HSM (~$1,373/mo) + $1.45/hr for backup; Azure Dedicated HSM $1.80/hr (~$1,314/mo); Thales Luna on-prem $25k appliance + $5k/yr maintenance; Fortanix DSM SaaS $1/key/mo
Data Loss Prevention (DLP) - Endpoint/Network/Cloud
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNightfall Free 100 files/mo scanned, Pro $20/mo/1000 files, Enterprise $500/mo/10k; Purview DLP $4/user/mo (E5 includes), $5/user/mo standalone; Symantec DLP $50k/yr 500 users + $12k implementation; Forcepoint $45k/yr; Microsoft $48/user/yr
Tokenization Vault / Format Data Vault
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsSkyflow Free 100k tokens, Pro $1,000/mo includes 1M tokens + $0.001/token overage + $0.10/GB-mo storage; VGS Free 500 tokens, Sandbox Free, Zero $500/mo 5k tokens, Enterprise $2,500/mo 100k; Basis Theory Free 2k tokens, Growth $500/mo; Protegrity $80k/yr
Data Classification Engine
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsPurview MIP P1 $2/user/mo, P2 $5/user/mo; Spirion Data Platform $30k/yr 50k files, $75k/yr enterprise; Varonis $40k/yr 250 users, $100k/yr enterprise; BigID $50k/yr starter, $150k enterprise 1M records; Symmetry $45k/yr
Data Access Control / Policy Engine (ABAC/RBAC/PBAC)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsOPA Free OSS; Ranger Free; OpenFGA Free; Cerbos Free 1k PDP/s, Cloud $200/mo 10k; Immuta $50k/yr starter 25 users, $150k enterprise; Privacera $40k/yr, Cloud $2,500/mo; Okera $30k/yr; Cyral $60k/yr
Envelope Encryption Service
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free; HCP Vault Transform $0.03/hr + $0.20/10k transforms; AWS KMS DEK local free + KEK $1/key/mo $0.03/10k; GCP EKM $3/key version/mo via partner HSM; Fortanix $1/key/mo + $0.10/10k ops
Field-Level Encryption / Record-Level
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMongoDB CSFLE Free Community (KMS $1/key/mo); DynamoDB client Free + KMS $1/key/mo + $0.25/M WCU; Voltage $75k/yr; Baffle $60k/yr; Skyflow Field-level included $1k/mo Pro
Data Discovery & Inventory / Data Catalog for PII
Scheduling, availability, and booking logic. Core to any appointment or reservation product.Pricing & free-tier limitsOpenMetadata Free OSS; DataHub Free; BigID $50k/yr starter 2 sources 100k records, Enterprise $150k/yr unlimited; OneTrust $40k/yr starter; Varonis $40k/yr; Securiti $45k/yr
Database Activity Monitoring (DAM) / Audit
Persistent storage for your app’s data — users, products, orders. The single most important architectural decision for most projects.Pricing & free-tier limitspgAudit Free; RDS Activity Streams Free + Kinesis $0.014/GB ingested + $0.023/GB storage; Azure Auditing $0.15/GB-mo; Imperva DAM $60k/yr per DB; Guardium $18k/vCPU + $15k/yr; DataSunrise $8k/db/yr
Data Masking / De-identification / Pseudonymization
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsARX Free GPL; Faker Free; Vault Transform FPE $0.03/hr + $0.20/10k; Tonic.ai Free 1 DB, Startup $500/mo, Growth $2,000/mo; Delphix Masking $50k/yr; Informatica PDM $70k/yr; Baffle $60k/yr
Format-Preserving Encryption (FPE) / Tokenization Format
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFF3 lib Free; Vault Transform HCP $0.03/hr + $0.20/10k FPE ops, Free 1k ops/mo; Voltage SecureData $75k/yr includes FPE; Protegrity $80k/yr; Thales CipherTrust FPE $15k/yr add-on; Skyflow FPE included $1k/mo
Column-Level Encryption
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitspgcrypto Free; Azure Always Encrypted Free driver + AKV $1/key/mo; Oracle Column TDE $11,500/processor; Imperva $60k/yr; Thales $10k/yr/host + $2k/col; SQL Server Always Encrypted free feature Enterprise edition $13,748/2-core
File-Level Encryption Agent
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsGocryptfs Free; Cryptomator Free OSS, Pro $50 one-time; Boxcryptor Free 1 provider + 2 devices, Personal $36/yr $3/mo, Business $90/yr/user; Thales CTE $10k/yr/server; PGP $60/user/yr; Microsoft AIP File $2/user/mo
Secrets Rotation for Databases / Dynamic Credentials
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free; AWS Secrets $0.40/secret/mo + $0.05/10k API calls, rotation free Lambda; Akeyless Free 2k secrets, Team $20/mo 2k, Enterprise $200/mo 20k; Doppler $10/user/mo; CyberArk $35k/yr starter
Secure Enclave / Confidential Computing / TEE
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNitro Enclaves Free feature, EC2 cost + enclave vCPU $0.05/hr (e.g., c6a.xlarge $0.153/hr); GCP Confidential VM +10% premium $0.02/vCPU/hr; Azure Confidential $0.10/vCPU/hr premium + VM cost; Fortanix Enclave Manager $50k/yr; Anjuna $75k/yr
Bring Your Own Key (BYOK) / Hold Your Own Key (HYOK)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS KMS BYOK import $1/key/mo; XKS $1/key/mo + external store $1.88/hr CloudHSM; GCP EKM BYOK via partner $3/key/mo; Azure Key Vault BYOK $1/key/mo, Managed HSM $1.40/hr; Thales HYOK $30k/yr; Purview Double Key $6/user/mo; Fortanix DSM BYOK $1/key/mo
Dynamic Data Masking (DDM) / Real-time Masking
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsPostgres Anonymizer Free GPL; Azure SQL DDM Free feature; Oracle Redaction $11,500/processor; Imperva DDM $45k/yr per DB; Delphix $50k/yr; Informatica DDM $60k/yr; Fastpath DDM $25k/yr
SSH Key Management / SSH Certificate Authority
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsVault SSH CA Free OSS; Teleport Community Free 200 nodes, Starter $17/node/mo, Enterprise $25/node/mo; Boundary OSS Free, HCP $0.03/hr; AWS EC2 IC Free; CyberArk PSM $40k/yr; Foxpass $5/user/mo $100/mo minimum
Encryption Gateway / Database Proxy / Tokenization Proxy
Persistent storage for your app’s data — users, products, orders. The single most important architectural decision for most projects.Pricing & free-tier limitsVGS Proxy Free 500 tokens, $500/mo 5k, Enterprise $2.5k; Basis Theory $500/mo includes proxy + 10k tokens; Protegrity Gateway $80k/yr; Voltage $75k/yr; Baffle $60k/yr; Cyral $60k/yr $5k/mo
How this professional data security checklist works.
Each requirement below is something a professional data security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.