Definition
Customer-managed encryption keys are keys that a customer creates, owns and controls in its own key management service to protect data held by a cloud or software provider. The term covers both Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK) models.
Most software vendors encrypt data at rest with keys they manage themselves. Customer-managed keys shift ownership of the key to the customer. AWS draws the same line between customer managed keys and AWS managed keys: with a customer managed key, the customer sets the key policy, controls rotation and can disable the key.
The three common models
Model | Who holds the key | Where data is decrypted |
|---|---|---|
Vendor-managed | The vendor | Vendor servers |
BYOK | The customer, in its own KMS | Vendor servers, using the customer's key for each use |
HYOK | The customer, in its own KMS | The customer's own environment |
The models trade control against features. Vendor-managed and BYOK keep every feature, because the vendor can decrypt. HYOK removes the vendor's ability to read stored values, so features that need the plaintext don't run on those fields.
How it works
Customer-managed keys almost always use envelope encryption. Data is encrypted with data keys, and those data keys are wrapped by the customer's master key. The customer grants the vendor narrow rights to use the master key, watches every use in its own audit logs, and can revoke access by disabling the key or changing its policy.
Why banks and regulators care
Encryption keys sit at the center of data protection reviews. Commission Delegated Regulation (EU) 2024/1774 requires EU financial entities to manage cryptographic keys through their whole lifecycle and protect them against loss and unauthorized access. NIST SP 800-57 gives the reference practice for key management. US interagency guidance on third-party relationships asks banks to assess a vendor's information security controls. None of these require a specific model, so banks choose based on data classification: BYOK where ownership and revocation are enough, HYOK where the vendor must not be able to read stored values.
How Corsa supports it
Corsa offers all three models for sensitive client fields such as names, government ID numbers and contact details. Corsa-managed encryption is the default, with AES-256 at rest and TLS 1.2 or higher in transit. BYOK uses a symmetric AWS KMS key in the customer's account, keeps every feature, and records every key use in the customer's CloudTrail. HYOK uses an RSA key in the customer's AWS KMS and decrypts only in authorized users' browsers through a Secure Viewer in the customer's AWS account, with exact-match search and screening on encrypted fields. Workspaces choose one tier, and only Owners can change the encryption configuration. See Corsa-managed vs BYOK vs HYOK.
How Corsa helps:
Security & data privacy →
Frequently asked questions
Are customer-managed keys the same as BYOK?
BYOK is one form of customer-managed keys. The term also covers HYOK, where the customer both holds the key and performs decryption in its own environment.
Do customer-managed keys reduce product features?
BYOK doesn't, because the vendor can still decrypt while the key allows it. HYOK does on the encrypted fields, because the vendor can't read them. In Corsa, HYOK fields support exact-match search and screening but not fuzzy matching or AI.
Which compliance platforms support customer-managed keys?
Corsa documents both BYOK and HYOK for AML compliance, using keys in the customer's AWS KMS. Many compliance vendors document vendor-managed encryption at rest only, so ask each vendor who holds the key and where decryption happens.
