Firebase Firestore is a cloud-hosted NoSQL database provided by Google. It lets you store and sync data between your users in real-time, making it perfect for mobile apps. However, securing Firestore is crucial to prevent unauthorized access and data breaches.

Start by implementing Firebase Authentication. This service allows users to authenticate with your app using one or many authentication methods, including email/password, OAuth providers like Google and Facebook, and more. After signing in, users are provided with a unique identifier token, which is used to identify them in your Firebase project.

After setting up Firebase Authentication, you should implement Firestore Security Rules. These rules determine who has read and write access to your Firestore database. They enable you to create conditional rules that allow or disallow a user to read or write data from specific reference paths in your database. To secure Firestore, you should ensure that every database reference path has a security rule associated with it.

Data stored in Firestore is encrypted at rest and in transit by default, but this does not protect data from being seen by privileged users or by someone who manages to get a hold of an authenticated user's token. To add an extra layer of security, you can implement client-side encryption, which ensures that sensitive user data is encrypted before it is sent to Firestore database.

The first step in implementing client-side encryption is selecting an encryption library that works on the client platforms you're targeting. One option is Google's Tink library, which has implementations for many different languages and platforms.

With your encryption library set up, you can now use it to encrypt sensitive user data before sending it to Firestore. The exact process will differ based on the library and encryption algorithm you're using, but in general, you'll take a piece of data, a key, and input them into an encrypt function, which will output the encrypted data.

The keys used to encrypt and decrypt data should be stored separately from the data itself. This helps ensure that even if someone gets a hold of the data, they won't be able to decrypt it without the corresponding key.

Finally, when you need to read the encrypted data, you'll use the same key to decrypt them on the client side. This ensures that the data stays encrypted while it's being stored and transmitted, but you can still make use of it in your app.