If you are using MultiChain Enterprise with read-permissioned streams, MultiChain takes care of all encryption for you. Otherwise, you would perform encryption in your application, before publishing the data to a stream, and then perform decryption in your application when reading the data.