7.4 Customer-Managed Encryption Keys (CMEK) & Key Rotation
How to enforce envelope encryption using AWS KMS or HashiCorp Vault master keys and how key rotation works.
Envelope Encryption, Explained Plainly
Section titled âEnvelope Encryption, Explained PlainlyâCMEK is more specific than âyour data is encrypted at restâ â itâs about who holds the key that ultimately protects everything else. Each tenant gets its own Data Encryption Key (DEK), generated by CertiQA and used with AES-GCM-256 to encrypt secrets and test-step payloads before they ever touch PostgreSQL. That DEK itself never sits on disk in plaintext: itâs wrapped by your own AWS KMS or HashiCorp Vault master key (the Key Encryption Key, or KEK) into an Encrypted Data Key, and only that wrapped form is what CertiQA actually stores. Decrypting anything requires calling out to your KMS or Vault to unwrap the DEK first â meaning the key that actually protects your data at rest never leaves infrastructure you control.
Rotating the Key
Section titled âRotating the KeyâAn organization admin rotates the key from the organization enterprise security settings with the Rotate Encryption Key Now button. Rotation moves the organization to a new key version and re-encrypts its stored vault secrets under it. Rotate when no run depends on reading a secret at that moment, and check the audit trail afterward.