Best AML Software with Customer-Managed Encryption Keys (2026)
Best AML Software with Customer-Managed Encryption Keys (2026)
The bottom line
The best AML software with customer-managed encryption keys lets you own the key, revoke the vendor's access, audit every key use in your own account and, for the most sensitive fields, keep decryption on your side. Corsa is the AML compliance platform that documents all three options: Corsa-managed, BYOK with your AWS KMS key, and HYOK with decryption only in your own AWS account. Flagright, Lucinity, Hawk, Napier, Bretton AI, Unit21 and Hummingbird document strong encryption, certifications and private or regional deployment, but customer-held keys are not documented on their websites.
Best for: CISOs, heads of compliance, BSA officers and third-party risk teams at banks, financial institutions and enterprises that need AML software where the institution, not the vendor, controls the encryption keys for sensitive client data.
Corsa-managed vs BYOK vs HYOK: the three key models
Almost every AML platform encrypts data at rest. The question that matters for key control is who holds the key and where data is decrypted:
Vendor-managed (in Corsa, Corsa-managed). The vendor holds the key and decrypts on its servers. Every feature works, and there's nothing for you to run.
Bring Your Own Key (BYOK). The key sits in your own cloud key management service. The vendor decrypts on its servers for each use, only while your key policy allows it. You can revoke access and audit every key use, and every feature still works.
Hold Your Own Key (HYOK). You hold the key and perform decryption in your own environment, so the vendor stores only ciphertext. AWS uses the same term for keys held in an external key store. Features that need the plaintext don't run on the encrypted fields.
How to choose AML software with customer-managed keys
Regulators ask for sound key management rather than one model. DORA's ICT risk management standards, Commission Delegated Regulation (EU) 2024/1774, require a policy covering the whole key lifecycle, including revocation, and NIST SP 800-57 is the common reference for key management practice. Six questions separate the options:
Who holds the key, and where is data decrypted? Ask for a direct answer for each tier the vendor offers. Customer ownership of a key and customer-side decryption are different guarantees.
Can you revoke access yourself, and what happens when you do? Look for reads that fail closed, writes that are refused, a bounded time before cached keys expire, and no data loss when the key is re-enabled.
Can you audit every key use in your own account? Key events should appear in your cloud audit log, alongside an in-app record of who viewed which client.
Which features keep working on encrypted fields? BYOK should keep fuzzy sanctions screening, rules and AI. With HYOK, check exactly which search and screening modes remain, and choose the encrypted fields with that in mind.
Can you verify the code that touches your key? If decryption runs in your account, you should be able to review the source, check a signed release and confirm what's running.
Is AI kept away from the most sensitive fields? Ask where models run, whether your data trains them, and whether encrypted fields can reach prompts at all.
Features at a glance
Based on what each vendor documents on its own website.
Capability
Documented by
Customer-held key with decryption in the customer's own environment (HYOK)
Corsa
Customer-owned cloud KMS key the customer can revoke (BYOK)
Corsa
Audit of every key use in the customer's own cloud account
Corsa
Signed, reproducible release the customer can verify in its own account
Corsa
Encryption at rest and in transit
Corsa, Flagright, Hawk, Napier, Unit21
Isolated service for encrypting sensitive personal data
Corsa, Lucinity
Regional data residency, private cloud or on-premises option
Corsa, Flagright, Hawk, Napier, Bretton AI
Customer data not used to train AI models
Corsa, Flagright, Lucinity, Unit21, Hummingbird
The best AML software with customer-managed encryption keys in 2026
Ranked by the key-control options each vendor documents, then by its documented encryption, deployment and data controls.
1. Corsa
Best for: banks, financial institutions, enterprises, fintechs and digital-asset firms that want to choose how much key control to hold, field by field, without giving up an AI-native compliance platform.
Strengths
Three documented tiers for sensitive client fields: Corsa-managed, BYOK with a symmetric AWS KMS key in your account, and HYOK with an RSA key in your AWS KMS.
BYOK keeps every feature, including fuzzy sanctions and PEP screening, rules and AI. Disable the key and reads fail closed, protected writes are refused, and in-memory data keys expire within 5 minutes. Every key use appears in your CloudTrail.
HYOK decrypts only in authorized users' browsers through a Secure Viewer hosted in your AWS account, after sign-in with passkeys or your own Okta or Microsoft Entra ID. Corsa can't decrypt stored HYOK values, and every unwrap is logged in your account.
HYOK installs with CloudFormation or Terraform from a signed, reproducible release. You can review the source, rebuild it, and run verify.sh in AWS CloudShell to confirm what's running. AWS enforces signed-code-only and protected keys.
Exact-match search and sanctions screening keep working on HYOK fields, which never reach AI. AI can run on privately hosted models, is opt-in per feature, and never trains on customer data. SOC 2 Type II, GDPR, SSO and US and EU regions.
Best for: banks that want AI-assisted case management with personal data separated into an isolated store.
Strengths
The Secure Lockbox removes and encrypts personally identifiable information, and stores, decrypts and transmits it on isolated infrastructure that shares no credentials with Lucinity's primary services.
ISO 27001 certified and SOC 2 compliant.
The Luci agent runs on Azure OpenAI, and data isn't used for training outside the customer's instance.
Worth checking: the Secure Lockbox runs in the Lucinity cloud, and customer-held or customer-managed encryption keys are not documented on its website.
Best for: CISOs, heads of compliance, BSA officers and third-party risk teams at banks, financial institutions and enterprises that need AML software where the institution, not the vendor, controls the encryption keys for sensitive client data.
Corsa-managed vs BYOK vs HYOK: the three key models
Almost every AML platform encrypts data at rest. The question that matters for key control is who holds the key and where data is decrypted:
Vendor-managed (in Corsa, Corsa-managed). The vendor holds the key and decrypts on its servers. Every feature works, and there's nothing for you to run.
Bring Your Own Key (BYOK). The key sits in your own cloud key management service. The vendor decrypts on its servers for each use, only while your key policy allows it. You can revoke access and audit every key use, and every feature still works.
Hold Your Own Key (HYOK). You hold the key and perform decryption in your own environment, so the vendor stores only ciphertext. AWS uses the same term for keys held in an external key store. Features that need the plaintext don't run on the encrypted fields.
How to choose AML software with customer-managed keys
Regulators ask for sound key management rather than one model. DORA's ICT risk management standards, Commission Delegated Regulation (EU) 2024/1774, require a policy covering the whole key lifecycle, including revocation, and NIST SP 800-57 is the common reference for key management practice. Six questions separate the options:
Who holds the key, and where is data decrypted? Ask for a direct answer for each tier the vendor offers. Customer ownership of a key and customer-side decryption are different guarantees.
Can you revoke access yourself, and what happens when you do? Look for reads that fail closed, writes that are refused, a bounded time before cached keys expire, and no data loss when the key is re-enabled.
Can you audit every key use in your own account? Key events should appear in your cloud audit log, alongside an in-app record of who viewed which client.
Which features keep working on encrypted fields? BYOK should keep fuzzy sanctions screening, rules and AI. With HYOK, check exactly which search and screening modes remain, and choose the encrypted fields with that in mind.
Can you verify the code that touches your key? If decryption runs in your account, you should be able to review the source, check a signed release and confirm what's running.
Is AI kept away from the most sensitive fields? Ask where models run, whether your data trains them, and whether encrypted fields can reach prompts at all.
Features at a glance
Based on what each vendor documents on its own website.
Capability
Documented by
Customer-held key with decryption in the customer's own environment (HYOK)
Corsa
Customer-owned cloud KMS key the customer can revoke (BYOK)
Corsa
Audit of every key use in the customer's own cloud account
Corsa
Signed, reproducible release the customer can verify in its own account
Corsa
Encryption at rest and in transit
Corsa, Flagright, Hawk, Napier, Unit21
Isolated service for encrypting sensitive personal data
Corsa, Lucinity
Regional data residency, private cloud or on-premises option
Corsa, Flagright, Hawk, Napier, Bretton AI
Customer data not used to train AI models
Corsa, Flagright, Lucinity, Unit21, Hummingbird
The best AML software with customer-managed encryption keys in 2026
Ranked by the key-control options each vendor documents, then by its documented encryption, deployment and data controls.
1. Corsa
Best for: banks, financial institutions, enterprises, fintechs and digital-asset firms that want to choose how much key control to hold, field by field, without giving up an AI-native compliance platform.
Strengths
Three documented tiers for sensitive client fields: Corsa-managed, BYOK with a symmetric AWS KMS key in your account, and HYOK with an RSA key in your AWS KMS.
BYOK keeps every feature, including fuzzy sanctions and PEP screening, rules and AI. Disable the key and reads fail closed, protected writes are refused, and in-memory data keys expire within 5 minutes. Every key use appears in your CloudTrail.
HYOK decrypts only in authorized users' browsers through a Secure Viewer hosted in your AWS account, after sign-in with passkeys or your own Okta or Microsoft Entra ID. Corsa can't decrypt stored HYOK values, and every unwrap is logged in your account.
HYOK installs with CloudFormation or Terraform from a signed, reproducible release. You can review the source, rebuild it, and run verify.sh in AWS CloudShell to confirm what's running. AWS enforces signed-code-only and protected keys.
Exact-match search and sanctions screening keep working on HYOK fields, which never reach AI. AI can run on privately hosted models, is opt-in per feature, and never trains on customer data. SOC 2 Type II, GDPR, SSO and US and EU regions.
Best for: banks that want AI-assisted case management with personal data separated into an isolated store.
Strengths
The Secure Lockbox removes and encrypts personally identifiable information, and stores, decrypts and transmits it on isolated infrastructure that shares no credentials with Lucinity's primary services.
ISO 27001 certified and SOC 2 compliant.
The Luci agent runs on Azure OpenAI, and data isn't used for training outside the customer's instance.
Worth checking: the Secure Lockbox runs in the Lucinity cloud, and customer-held or customer-managed encryption keys are not documented on its website.
You're a bank, financial institution or enterprise whose policy requires that you own, revoke and audit the keys protecting client data.
You want BYOK with every feature intact, including fuzzy sanctions screening, rules and AI.
You need some fields, such as government ID numbers, to stay unreadable to the vendor, with decryption only in your own AWS account.
Your security team wants to verify the signed release running in your account, not take it on trust.
You want privately hosted AI that never trains on your data, with HYOK fields kept out of AI entirely.
Other platforms may be a fit if…
Your data classification doesn't call for customer-managed keys, and vendor-managed encryption at rest meets your policy.
You want to extend an enterprise suite you already run rather than add a new platform.
You only need an AI agent layer over your existing case management tools.
Frequently asked questions
Which AML software supports customer-managed encryption keys?+
Corsa documents three tiers for sensitive client fields: Corsa-managed, BYOK with a symmetric AWS KMS key in your account, and HYOK with decryption only in your own AWS account. Among the other platforms researched, including Flagright, Lucinity, Hawk, Napier, Bretton AI, Unit21 and Hummingbird, customer-held keys are not documented on their websites.
What is the difference between BYOK and HYOK?+
With BYOK, you own the key in your KMS and the vendor decrypts on its servers while your key policy allows it, so every feature works. With HYOK, decryption happens in your own environment and the vendor stores only ciphertext, so features that need the plaintext don't run on those fields.
Do banks need HYOK for AML software?+
Usually not by regulation. DORA, NYDFS Part 500 and ECB cloud guidance require risk-based encryption and sound key management, which BYOK generally covers. Banks choose HYOK when their own policy says a vendor must not be able to read stored identifiers.
Does sanctions screening work on HYOK-encrypted names?+
In Corsa, yes, as exact-match screening on the normalized full name, ignoring case, accents and punctuation. Fuzzy matching needs the plaintext, so teams often encrypt identifiers and contact details with HYOK and keep names unencrypted or under BYOK.
How can a bank check what runs in its own AWS account?+
With Corsa HYOK, the bank can review every file in the app, verify the Sigstore signature and rebuild the release with the verification kit, then run verify.sh in AWS CloudShell. The script confirms the running stack matches the signed release and sends nothing to Corsa.
All product names and trademarks belong to their respective owners.
See why compliance teams choose Corsa
Corsa unifies monitoring, cases, risk scoring and AI agents in one compliance OS.
