If you have the operational manpower, Vault is a good solution as well. With Vault you can create an endpoint that will encrypt/decrypt data with a key that only Vault knows. You can have a unique endpoint for each user.

Then in your application when the user submits some data, you ask Vault to encrypt it before you store it in your main data store. When you need to read it, you get that value from your store and ask Vault to decrypt it.

If you have different services doing the reading/writing you can even setup your permissions so that one service can only decrypt and the other can only encrypt.

I'm a little confused; the system mentioned in this article allows services to retrieve secrets in plaintext; they're just stored encrypted at rest. You can do what you like with the retrieved secret.