A bit of both — sensitive fields like SMTP credentials and API keys are encrypted at the application level regardless of your infrastructure. Broader disk-level encryption (encrypting the entire database volume) is on your infrastructure, since that's determined by your server/cloud provider setup rather than anything the application controls. Most cloud providers (AWS, DigitalOcean, etc.) offer encrypted volumes as a checkbox at provisioning time, which we'd recommend enabling for defense in depth beyond just the application-level encryption.