All your IO should be in a Repository, so by that logic, you should have logic to store/encrypt and retrieve/decrypt logic into your repository itself.