Definition
Hold Your Own Key (HYOK) is an encryption model in which the customer, not the software vendor, holds the key and performs decryption in an environment it controls. The vendor stores only ciphertext and can't decrypt the protected data on its own.
HYOK is the strictest form of customer-managed encryption. With Bring Your Own Key (BYOK), the customer owns the key but the vendor's service still decrypts data while the key allows it. With HYOK, the decryption step itself moves to the customer's side, so the vendor never holds plaintext for the protected fields at rest. AWS uses the same term for KMS keys whose key material sits in an external key store outside AWS.
How it works
HYOK systems usually rely on envelope encryption. Each value is encrypted with its own data key, and that data key is wrapped by a master key the customer controls, often in a hardware-backed key management service. To read a value, an authorized user or service sends the wrapped data key to the customer's environment, which checks the request and unwraps it. Good designs add three things:
Customer-side identity. Decryption requires a sign-in the customer manages, so the vendor can't impersonate a user.
Binding. Each wrapped key is tied to the field and tenant it belongs to, so ciphertext can't be replayed elsewhere.
A customer-side audit log. Every unwrap is recorded where the customer, not the vendor, controls the records.
The trade-off is functional. A vendor that can't read a value can't run fuzzy search, fuzzy matching or AI on it, so HYOK is normally applied to selected high-sensitivity fields rather than to everything.
Why banks and regulators care
EU financial entities must keep an encryption and cryptographic key management policy that covers the whole key lifecycle under DORA's ICT risk management standards, Commission Delegated Regulation (EU) 2024/1774. US guidance on third-party relationships asks banks to assess how vendors protect customer information. These rules require sound key management, not HYOK specifically. Banks adopt HYOK when internal policy says a vendor must not be able to read stored identifiers, or when they want cut-off and audit evidence in an account they control.
How Corsa supports HYOK
Corsa HYOK encrypts eligible client fields, such as names, government ID numbers and contact details, under an RSA key in the customer's AWS KMS. Values are decrypted only in authorized users' browsers through a Secure Viewer hosted in the customer's AWS account, after sign-in with passkeys or the customer's own OIDC provider such as Okta or Microsoft Entra ID. Decryption needs both the customer's sign-in and a short-lived Corsa token issued after Corsa's access check. Customers install the stack with CloudFormation or Terraform, can verify the signed, reproducible release running in their account, and can stop all decryption by disabling the key. Exact-match search and sanctions screening keep working on encrypted fields through a keyed index, and HYOK fields are never available to AI. See HYOK for AML compliance.
How Corsa helps:
Security & data privacy →
Frequently asked questions
What is the difference between HYOK and BYOK?
With BYOK, the customer owns the key but the vendor decrypts data on its servers while the key allows it. With HYOK, decryption happens in the customer's own environment, so the vendor stores only ciphertext and can't decrypt the protected values on its own.
Do regulations require HYOK?
Generally no. Frameworks such as DORA and NYDFS Part 500 require risk-based encryption and sound key management. Institutions choose HYOK when their own policy requires that a vendor can't read stored sensitive data.
What are the trade-offs of HYOK?
Features that need the plaintext don't run on HYOK fields. In Corsa, search and sanctions screening on those fields are exact-match only, and AI doesn't receive their values, so teams usually encrypt only selected high-sensitivity fields.
