How do you implement end-to-end encryption and data protection for applications?
End-to-end encryption (E2EE) ensures only intended recipients can read data, not even the service provider. Implementation layers: transport encryption (TLS 1.3 for all network communication), at-rest encryption (AES-256 for stored data), field-level encryption (encrypt specific sensitive fields before storage), and E2EE (encrypt on client, decrypt only on intended recipient's client). TLS implementation: enforce HTTPS everywhere, implement HSTS (Strict-Transport-Security header with long max-age), configure TLS 1.3 with strong cipher suites, implement certificate pinning for mobile apps, and automate certificate management with Let's Encrypt or cloud certificate managers. At-rest encryption: enable storage encryption (AWS EBS encryption, GCS default encryption), implement database encryption (PostgreSQL TDE, or column-level encryption using pgcrypto), and encrypt backups and archives. Key management: use cloud KMS (AWS KMS, Google Cloud KMS, Azure Key Vault) for key storage and rotation, implement envelope encryption (data encrypted with data key, data key encrypted with master key), rotate encryption keys on schedule (annually for master keys, more frequently for data keys), and implement key access auditing. Field-level encryption: encrypt PII fields before storing in database, implement searchable encryption for fields that need querying (deterministic encryption enables equality search), and implement application-level encryption using libraries (libsodium, Web Crypto API). E2EE implementation: generate key pairs per user (public/private), encrypt messages with recipient's public key, store encrypted data on server (server cannot decrypt), implement key exchange protocols (X3DH for asynchronous messaging), and handle key backup and recovery. Data protection: implement data masking for non-production environments, tokenization for payment card data (PCI DSS compliance), and data loss prevention (DLP) rules for sensitive data handling. Compliance: maintain encryption inventory documenting what is encrypted and how, ensure compliance with regulations (GDPR encryption requirements, HIPAA encryption standards, PCI DSS encryption requirements), and conduct regular security assessments of encryption implementations.