I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since the data being encrypted is personally identifiable information (PII) and the requirement is to be PII compliant, I am encrypting it all with AES256-CBC were the IV is generated randomly at each encryption and data is stored in a binary field in this format
the version field is for future use should I need to change encryption/decryption algorithm, the IV is random and then the encrypted data.
as for the AES key, I am hashing the company GUID the database record belongs to using SHA256 (resulting in the same key on each server that is trying to decrypt the record from the DB) I am unable to use SQL encryption for various reasons and must use code for encryption/decryption.
Is this PII encryption scheme secure? Any downsides? I know that no matter what key generation code I build, a hacker if he is already on my server could use a debugger or look at the .NET IL to decode what I am doing. That said, if he only gets the raw data from the DB is that data secure?