Security & governance
Bring your own key (BYOK)
Bring your own key (BYOK) is an encryption arrangement in which a customer generates its own cryptographic key and supplies it to a service provider, which then uses that key to protect the customer's data. The customer decides how the key is created and can revoke it. The key itself, once imported, is held and used inside the provider's key management service.
How does BYOK work?
The customer creates a key in its own hardware security module or key manager, wraps it for transport and imports it into the provider's key management service. From then on the provider's storage and compute services call that key service to encrypt and decrypt data, usually through envelope encryption. The customer keeps a copy of the key material, sets rotation and can disable or delete the imported key, at which point data protected by it becomes unreadable.
What control does BYOK give, and what does it leave?
BYOK improves control over the key lifecycle. It does not remove the provider from the trust boundary.
| Question | With BYOK |
|---|---|
| Who generates the key? | The customer |
| Where is the key used? | Inside the provider's key service |
| Can the provider technically use the key? | Yes, its services call it on the customer's behalf |
| Can the customer revoke access? | Yes, by disabling or deleting the key |
| Does it prevent compelled disclosure by the provider? | No, while the key is active in the provider's service |
How does BYOK differ from HYOK?
With BYOK the key lives in the provider's environment after import. With hold your own key, the key stays in a system the customer operates outside the provider, and the provider must ask that system each time it needs to decrypt. HYOK gives stronger separation and brings operational consequences, since the customer's key system becomes a dependency for every access. BYOK is the more common choice because it is simpler to run.
When is BYOK the right fit?
BYOK suits organizations that need to show they control key creation and rotation, want the ability to cut off access by revoking a key, and accept that the provider's services handle the key in use. It is frequently used to satisfy audit requirements for key ownership. Where the requirement is that the provider must be technically unable to read the data, for example to address extraterritorial data access, BYOK alone does not meet it. Encryption keys and data sovereignty compares the models.
Frequently asked questions
Does BYOK mean the provider cannot see the data?
No. The provider's services use the key to decrypt data during normal operation.
What happens if the customer deletes its BYOK key?
Data encrypted under it can no longer be decrypted, by the customer or the provider, unless another copy of the key exists.
Is BYOK the same as customer-managed keys?
The terms overlap. Customer-managed keys are keys the customer controls in the provider's key service. BYOK adds that the key material was generated outside and imported.
Related terms
- Hold your own key (HYOK): keys kept entirely outside the provider.
- Key management service (KMS): where an imported key lives.
- Envelope encryption: how the key is applied to data.
- Encryption at rest: the protection the key provides.
- Extraterritorial data access: a risk BYOK does not fully address.