Current status:

“Hi $vendor, I confess thatI’ve never seen a vendor explicitly state that their encryption-at-rest policy doesn’t cover servers. That’s a new one.”