One of the big issues with this approach is that your data is going to be sitting there in memory unencrypted. If you're caching any of this data in a second level cache that persists to disk you'll be writing cleartext. If the entity happens to implement a naive toString and then logged to disk you'll see that clear value in your log file.