class Customer < ApplicationRecord
encrypts :phone_number
encrypts :external_token, deterministic: true
end
Rails’ built-in encryption makes it easier to protect PII at rest. Use it for fields like phone numbers or external tokens. Combine with deterministic encryption when you need lookup-by-value.