"We encrypt sensitive data at rest" is a sentence I've heard applied to Pega apps that encrypt nothing beyond what's on disk at the storage layer. Platform Cipher with an external KMS is real, property-level encryption you control the keys for — but only for the properties you explicitly mark. Here's what it covers, what it costs you, and what it was never going to protect.