BYOK for AML compliance: bring your own AWS KMS key

In short: Bring Your Own Key (BYOK) means Corsa encrypts your sensitive client fields with a symmetric AWS KMS key that you create and control in your own AWS account. Corsa decrypts on its servers only while your key policy allows it, so every feature keeps working, including fuzzy sanctions screening, rules and AI. You can revoke Corsa's access at any time, and AWS CloudTrail records every use of the key in your account.

Three ways to protect sensitive fields in Corsa

All data in Corsa is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. For sensitive client fields, such as names, contact details and government ID numbers, you choose one of three tiers per workspace:

BYOK fits teams that need to own and revoke the key and audit its use while keeping every feature. HYOK fits fields that must stay unreadable to Corsa even while access is granted.

How BYOK works

• You create a symmetric AWS KMS key in your account. Its key policy lets Corsa's BYOK service role use the key only with the encryption context platformId set to your workspace ID, so the key can't be used for anyone else's data.

• When a protected field is written through the API, SDK, a KYC integration or the app, Corsa's isolated encryption service asks your key for a data key and encrypts the field with AES-256-GCM. Each value is bound to its workspace, entity type and field.

• Corsa stores the encrypted value and a keyed search index. It never stores the plaintext of protected fields.

• When an authorized user or service reads the field, the encryption service decrypts it with a data key that your KMS key unwraps.

Corsa caches decrypted data keys in memory for up to 5 minutes. That keeps latency low, and it bounds how long access continues after you revoke the key.

Every feature keeps working

Because Corsa can decrypt while your key allows it, BYOK keeps the full platform on protected fields: real-time rules and workflow triggers, fuzzy sanctions and PEP screening, fuzzy and partial search, duplicate detection, KYC integrations, Copilot and the AI agents, webhooks and exports. For AI, Corsa's other controls still apply: the option of privately hosted models, opt-in features, PII guardrails and a contractual guarantee that customer data is never used for training.

Revoke access at any time

Your kill switch lives in your AWS account. Disable the key, remove Corsa's statements from the key policy, or revoke a grant you created. After that:

• Reads fail closed. The app and API show protected fields as masked values with a Key revoked indicator, and Corsa never falls back to a different key.

• Writes of protected fields fail with HTTP 423 and error code KEY_REVOKED. Writes that don't touch protected fields keep working.

• Data keys already in memory expire within 5 minutes, and Corsa alerts you and shows the revoked state in Settings → Encryption.

• No data is lost. Re-enable the key or restore the policy, and Corsa resumes at the next verification.

Use disable, not deletion, as your kill switch. Data encrypted under a deleted KMS key can't be recovered by you or by Corsa.

Audit every key use in CloudTrail

Every KMS call Corsa makes appears in your own CloudTrail as a GenerateDataKey, Decrypt, Encrypt or DescribeKey event. Each event records the caller role, the time and the encryption context, including your workspace ID. Because data keys are cached for up to 5 minutes, one event can cover many field reads, so CloudTrail shows when and how often Corsa used the key. Corsa's own audit log records who viewed which client, and it can be exported to your SIEM.

Set up in four steps

• A workspace Owner opens Settings → Encryption and selects BYOK. Corsa shows your workspace ID, the Corsa BYOK role for your region and the AWS region to use.

• Deploy the key template prefilled for your workspace, or create the key yourself to the documented key policy requirements. You can add stricter conditions, such as a VPC endpoint condition.

• Paste the key ARN into the setup screen.

• Corsa runs an encrypt and decrypt round trip with your encryption context. On success, the key status becomes active and Corsa starts encrypting the fields you selected.

Corsa keeps monitoring the key after setup, and you can read its status, last verification time and last error from the encryption configuration endpoint.

Why banks choose BYOK

Frameworks such as DORA, NYDFS Part 500 and ECB cloud guidance ask for risk-based encryption and sound key management. DORA's ICT risk management standards, for example, cover the whole key lifecycle, including revocation. BYOK covers most bank and auditor requirements for key ownership and revocation without giving up any feature, and it produces evidence in the bank's own account. When some fields must stay unreadable to the vendor, HYOK adds customer-side decryption for those fields.

Learn more: Customer-managed encryption · BYOK documentation · HYOK for AML compliance · Private AI for compliance · Security and data privacy · Corsa for banks · Best AML software with customer-managed encryption keys