Setting up Bring Your Own Key (BYOK) encryption

BYOK lets you control the encryption key used to protect your tenant's data at rest. Instead of CybAura managing the key, you supply a key from your own cloud key management service (KMS). BYOK is available on the Enterprise plan.

How it works

CybAura performs envelope encryption: your data is encrypted with a data key, and that data key is itself encrypted ("wrapped") by your KMS key. CybAura never stores your root key — it calls your KMS to wrap and unwrap. If you revoke access, your data becomes unreadable.

Supported providers

• AWS KMS
• Azure Key Vault
• Google Cloud KMS

Setup steps

1. In your cloud provider, create a symmetric encryption key in KMS.
2. Grant CybAura's service principal permission to encrypt and decrypt with that key. The exact identity to authorise is shown in Settings → BYOK.
3. In CybAura, go to Settings → BYOK and select your provider.
4. Paste the key identifier (ARN, Key Vault URI, or resource name).
5. Select Validate — CybAura performs a test wrap/unwrap to confirm access.
6. Select Activate to begin using your key.

Key rotation

You can rotate your key at any time. Enable automatic rotation in your KMS, or trigger a re-wrap from Settings → BYOK → Rotate. Rotation re-wraps data keys without re-encrypting all your data, so it's fast.

Health checks

CybAura periodically verifies it can still reach your key. If access is lost (for example a policy change or revocation), you'll see an alert in Settings → BYOK and via your notification channels.

Important: If you revoke CybAura's access to your key, your tenant data cannot be decrypted and the platform will be unable to operate for your tenant until access is restored. Treat key permissions with care.