Only decrypt on persisted records