Here's an all-time great post about why you might consider SQLite in production with data about performance: https://blog.wesleyac.com/posts/consider-sqlite I use SQLite in production for my SaaS[1]. It's really great — saves me money, required basically no setup/configuration/management, and has had no scaling issues whatsoever with a few million hits a month. SQLite is really blazing fast for typical SaaS workloads…
how do you handle things like encryption and access permissions? The only thing I have against using SQLite in production (for my needs) is the lack of at rest encryption and row level permissions by user.
You don't do row level permissions on your database. You keep it all on the application layer.