Protection at rest

[ohouyoux]

I'd suggest that you have a look at the technical description of the ICE component.
Most of the concepts that are being used within this component should / could be written in your guidelines to ease developers researches.
But maybe you don't want that kind of description in a high level documentation and I would totally understand it.
Although encryption is difficult to inject into any project, they are quite a few secure recipes that do work amongst the plethora of choices.

I still maintain that in a microservices architecture you should have a bunch of servers should be dedicated to encryption / decryption.