The encryption key can probably be made into a module constant? This would decouple the module from SETTINGS and make it easier to test (also see the above comment).