BYOK gives the customer ownership of the key without moving the decryption step out of the vendor's service. The vendor still decrypts data to run its features, but only while the customer's key policy allows it. That keeps every feature working while giving the customer a kill switch and an audit trail in its own account.

How it works

In a typical cloud setup, the customer creates a symmetric key in a service such as AWS KMS and writes a key policy that lets the vendor's role use it. The vendor uses envelope encryption: it asks the key for a data key, encrypts each value with that data key, and stores the value with the wrapped data key. To read a value, it asks the customer's key to unwrap the data key.

• Scope. An encryption context condition can limit the vendor to the customer's own tenant.

• Audit. Each key operation is recorded in the customer's AWS CloudTrail.

• Revocation. Disabling the key or removing the vendor from the policy stops further decryption. Disabling is reversible. Deleting a key makes data encrypted under it unrecoverable.

What BYOK doesn't do

BYOK doesn't hide data from the vendor while access is granted. The vendor's services still read decrypted values to run screening, rules and other features. CloudTrail also shows when and how often the vendor used the key, not which individual record was read, because data keys are typically cached for a short time. Teams that need stored values to stay unreadable to the vendor use Hold Your Own Key (HYOK) for those fields.

Why banks and regulators care

Banks must show that they control the lifecycle of cryptographic keys protecting customer data. DORA's ICT risk management standards, Commission Delegated Regulation (EU) 2024/1774, require a key management policy covering generation through revocation and destruction, and NIST SP 800-57 sets out widely used key management practice. BYOK lets a bank own the key, revoke a vendor and produce evidence of key use from its own account, which covers most bank and auditor requirements for key ownership and revocation.

How Corsa supports BYOK

Corsa BYOK encrypts sensitive client fields with a symmetric AWS KMS key in the customer's account. The key policy lets Corsa's BYOK role use the key only with the customer's workspace ID as encryption context. Every product feature keeps working, including rules, fuzzy sanctions and PEP screening, search, KYC integrations and AI. If the customer disables the key, reads fail closed with a Key revoked indicator, writes of protected fields fail, in-memory data keys expire within 5 minutes, and no data is lost when the key is re-enabled. Every Corsa key use appears in the customer's CloudTrail. See BYOK for AML compliance.