stored in PostgreSQL, encrypted at rest. • Each customer's tokens are encrypted using derived per-customer keys. • Keys are derived from a master key and customer-specific UUIDs. • Keys are automatically rotated — re-encryption happens seamlessly. • Encryption and decryption are fully automated via Doctrine custom types. • Sensitive fields are transparently encrypted/decrypted on persist and hydrate. • No plaintext tokens are ever written to disk or logs.