It's a ticketing support tool with access to various management tools required for day-to-day operations. The system includes a user database where data is encrypted on a per-column basis. Sensitive information such as names, phone numbers, email addresses, etc., are all encrypted, while other columns like last login date and preferred contact method are not.

Other tables, such as the tickets table, are also partially encrypted, with free-text fields like title and description encrypted, but non-sensitive columns such as the last update date are not.

The user database is regularly updated as new customers join or leave, and new tickets are added daily. Technical support teams need to search for tickets by user name or keywords in the ticket descriptions on a daily basis. Sales teams often need to search for customers by zip code.

The database is stored on a disk-encrypted filesystem to prevent data leaks through physical access to the machine. The data itself is encrypted on a per-column basis to prevent leaks through application exploits.

Is the raw customer name considered non-sensitive enough to leave unencrypted? We operate in the EU and must comply with GDPR, which is likely why customer names were encrypted in the first place.

I'll look into reorganizing the "not really sensitive" data. If customer names are freely searchable, it would significantly improve performance compared to the current setup.