Hold your own key
HYOK for AML compliance: hold your own encryption key
Corsa HYOK keeps the encryption key for sensitive client fields in your own AWS account and decrypts them only in your authorized users' browsers, through a Secure Viewer hosted in your account. Corsa stores those fields only as ciphertext and can't decrypt them, and you can verify the signed release running in your account and cut off decryption at any time.
In short: Hold Your Own Key (HYOK) means the encryption key for your most sensitive client data stays in your own AWS account, and decryption happens there and in your authorized users' browsers, not on Corsa's servers. With Corsa HYOK, fields such as names, government ID numbers and contact details are stored in Corsa only as ciphertext. Corsa can't decrypt stored HYOK values, and you can cut off all decryption at any time by disabling your key in AWS KMS.
What HYOK means in Corsa
HYOK is the strictest of Corsa's three encryption tiers for sensitive client fields. With BYOK, the key sits in your AWS KMS and Corsa decrypts on its servers for each use. With HYOK, you host the decryption side yourself, so stored values stay unreadable to Corsa.
Each value is encrypted with its own random AES-256-GCM data key. That data key is wrapped with an RSA key in your AWS KMS, and the private key never leaves KMS. The wrapped key is bound to the workspace, entity type and field it belongs to, so ciphertext copied to another field or workspace doesn't decrypt.
How the Secure Viewer decrypts in your users' browsers
When an analyst opens a client in Corsa, the page embeds the Secure Viewer, which is served from your AWS account. Decryption follows a dual-token design:
The user signs in to your own identity: passkeys in a Cognito user directory that your stack creates, or your existing OIDC identity provider such as Okta or Microsoft Entra ID.
Corsa checks that the user may view that client, then issues a signed Corsa unwrap token that lasts at most 5 minutes and names the user's email, your stack and the exact fields on screen.
Your stack checks both tokens, confirms the user is in your decryptor group and that the emails match, and only then uses your KMS key to unwrap the data key.
The browser decrypts the value inside the Secure Viewer frame. The plaintext isn't sent back to Corsa.
Corsa can't decrypt alone, because it has no permission on your key and no identity in your sign-in. A user of your identity provider can't decrypt alone either, because they also need a Corsa token issued after Corsa's access check. Every unwrap, allowed or denied, is logged in your AWS account. Plaintext and keys are never logged.
Install in your AWS account with CloudFormation or Terraform
A workspace Owner starts setup in Settings → Encryption, chooses the fields to encrypt, and declares the AWS account and region. Corsa then shows the release version, its release digest and every file that will run in your account, and opens a CloudFormation quick-create page prepared for your workspace. Setup takes about 30 minutes. Teams that manage AWS with Terraform can install the same stack from a Terraform template.
The stack creates your HYOK key, your sign-in, the Secure Viewer, the decryption check and a signing key for everything it reports to Corsa. Review resources lists each resource before you deploy, so your AWS and security teams can approve it.
Signed releases you can verify yourself
Everything that runs in your stack comes from one signed, reproducible release. You can check it at three levels:
In-app source review. Browse every file of a release in Source audit. Your browser re-hashes each file against the signed manifest.
Verification kit. Check the Sigstore signature offline with cosign, recompute the release digest, and rebuild the release from source with the pinned builder image to get byte-identical files.
Running-stack check. Run verify.sh in AWS CloudShell to confirm the stack runs the release you reviewed, with signed-code enforcement, key protection and no outside access. The script sends nothing to Corsa.
AWS enforces two guardrails even if nobody reviews a change: your stack only accepts code signed by Corsa's release process, and a stack update can never replace or delete your HYOK key, your signing key or your Cognito users.
Operations: upgrades, health and cutting off decryption
Upgrades are optional. Older releases keep working, and you run each upgrade yourself after reviewing the source diff. A pre-upgrade check fails if a change set would replace your keys.
Signed health checks. Corsa polls your stack's signed health endpoint every 5 minutes and flags drift, such as code signing turned off.
Remove one person. Take them out of your decryptor group, and their next unwrap fails.
Pause everything. Disable your HYOK key in AWS KMS and nobody can decrypt until you re-enable it. Corsa keeps working on everything else, including exact search and exact-match screening.
Field-level choice and trade-offs
HYOK is a deliberate trade: in exchange for keeping stored values unreadable to Corsa, features that need the plaintext don't run on those fields. You decide which eligible fields to encrypt, and fields you leave unencrypted keep every feature.
On HYOK-encrypted fields | What you get |
|---|---|
Viewing values | Through the Secure Viewer, for members of your decryptor group |
Search and duplicate detection | Exact match on the normalized value |
Sanctions and PEP screening on names | Exact-match screening, labeled exact-hash match in the alert |
AI features | No plaintext reaches Copilot or the agents for these fields |
Exports and webhooks | Encrypted values, decrypted in the Secure Viewer |
Exact-match screening misses transliterations, typos and partial names, so many teams keep names unencrypted and encrypt identifiers and contact details, or choose BYOK for names. For exact search and screening, Corsa keeps a keyed index of searchable fields with a per-workspace salt that Corsa holds. Corsa-run KYC integrations such as Sumsub or Persona see plaintext in memory at ingest and encrypt it on arrival with your public key. Data you encrypt yourself with the Node.js SDK, or that users type into Secure Viewer input fields, never reaches Corsa as plaintext.
Why banks choose HYOK
Regulations such as DORA and NYDFS Part 500 require risk-based encryption and sound key management. They don't require a bank to hold the key itself. Banks choose HYOK when their own policy says a vendor must not be able to read stored identifiers, when they want decryption tied to their own identity provider and offboarding, or when they want key use and every unwrap recorded in an account they control. Security and audit teams get evidence they can check themselves: their KMS key policy, their CloudTrail, their decryption audit log and the output of verify.sh.
Learn more: HYOK overview and trust model · Set up HYOK · Verify the release · Features lost with HYOK · BYOK for AML compliance · Security and data privacy · Corsa for banks · Best AML software with customer-managed encryption keys
Frequently asked questions
What is HYOK in AML compliance software?
Hold Your Own Key (HYOK) means the customer keeps the encryption key and the decryption step on its own side. In Corsa, sensitive client fields are encrypted under an RSA key in your AWS KMS and decrypted only in your authorized users' browsers through a Secure Viewer hosted in your AWS account. Corsa stores only ciphertext and a keyed search index.
Can Corsa read HYOK-encrypted data?
Corsa can't decrypt stored HYOK values, because it has no permission on your KMS key and no identity in your sign-in. To support exact search and screening, Corsa keeps a keyed index with a salt it holds, and Corsa-run KYC integrations see plaintext in memory at ingest before encrypting it. Data you encrypt with the Node.js SDK never reaches Corsa as plaintext.
Does sanctions screening still work with HYOK?
Yes, as exact-match screening on encrypted names. A client matches when the complete normalized name equals a list name or alias, ignoring case, accents and punctuation. Fuzzy matching doesn't run on encrypted names, so many teams encrypt identifiers and contact details and keep names unencrypted, or use BYOK.
Can we use Okta or Microsoft Entra ID for HYOK decryption?
Yes. Your users can sign in to the Secure Viewer with your own OIDC identity provider, such as Okta or Microsoft Entra ID, using the authorization code flow with PKCE. You control who can decrypt with a group claim in your identity provider. The default alternative is passkeys in a Cognito directory that the stack creates in your account.
How do we verify what runs in our AWS account?
Review every file in the app's Source audit, check the Sigstore signature and rebuild the release with the verification kit, then run verify.sh in AWS CloudShell. The script confirms the stack runs the signed release with code signing and key protection in place, and it sends nothing to Corsa.
