chezmoi can use various external tools to keep data private. I prefer to use gpg since that is already installed/configured on my system anyway. In order to configure it, just set yourself as the recipient like this:

[gpg]
  recipient = "seb@hoß.de"

Calling chezmoi add --encrypt /path/to/secret will now create encrypt the file with your public key which allows you to decrypt them later with your private key.