- You can do the encryption at rest on the OS level, e.g. with LUKS. Cloudant does that.

- You can also lock out users in Offline-first apps when a session expires or permissions are removed. Not difficult with CouchDB and certain libraries.