A company is using storage-as-a-service from an IaaS provider for application services. The company has a mandate to protect personal information being stored on the cloud. The service provided includ

Data tokenization replaces sensitive values with non-sensitive surrogate tokens and is suited to specific use cases like payment card data, not a general-purpose solution for encrypting all personal data-at-rest across a cloud storage service.

Hardware-based encryption relies on physical hardware under the IaaS provider's control, which means the provider manages the encryption boundary and the company does not independently control key access.

Centralized key management separates cryptographic key custody from the physical storage managed by the IaaS provider, meaning the provider cannot access plaintext data without the company's keys. This approach directly satisfies the mandate to protect personal information at rest because encryption is applied by the company using keys the provider never holds, and key lifecycle operations such as rotation and revocation remain under the company's control.

Database-embedded encryption applies only to data stored within a specific database engine and does not address the broader storage-as-a-service scenario where personal data may reside in object or block storage outside a database.