What Are Customer-Managed Keys (CMK)?

Customer-managed keys (CMK) are encryption keys that you — not the storage or cloud provider — generate, hold and control, and that are used to encrypt your data at rest. Because the key lifecycle is yours, the provider stores ciphertext it cannot read without a key you supply and can withdraw.

The distinction that matters most is this: encryption at rest is nearly universal, but who controls the key decides who can actually read the data. "Encrypted" and "encrypted with a key only you control" are very different guarantees, and this page is about the second.

Customer-managed vs. provider-managed keys

Every encrypted storage service uses a key; the question is who holds it.

• Provider-managed keys are the default. The provider generates and stores the key and performs the cryptography for you. It is convenient, and it means the provider can decrypt your data — and can be compelled to.
• Customer-managed keys put the key under your control: you decide rotation, access policy, and when to revoke it. The provider can only decrypt while your key is available to it.

The practical consequence is control over disclosure. With provider-managed keys, a subpoena to the provider can produce readable data. With customer-managed keys, the provider can only produce ciphertext; the readable copy requires your key. That single difference is why regulated organizations treat key custody as a first-class control rather than a checkbox.

CMK vs. BYOK vs. HYOK

These acronyms are used loosely and describe a spectrum of how far the key stays under your control.

• CMK (customer-managed keys) is the umbrella: you manage the key's lifecycle — creation, rotation, policy and revocation.
• BYOK (bring your own key) narrows it: you generate the key material in your own KMS or HSM and import it into the provider's key service, which then performs the cryptographic operations inside its boundary.
• HYOK (hold your own key) is the strictest: the key never leaves your own key manager. The provider's platform calls out to your external KMS to unwrap data, so the key material stays entirely under your jurisdiction.

More control brings more responsibility. HYOK offers the strongest separation but introduces a real dependency: if your key manager is unreachable, the data is unreachable too. Choosing among them is a trade-off between control and operational resilience, not a simple "more is better."

How customer-managed keys work

Almost all at-rest encryption uses envelope encryption, and understanding it makes the CMK model concrete.

• Data is encrypted with a data encryption key (DEK), generated per object or volume.
• The DEK is itself encrypted ("wrapped") by a key encryption key (KEK) — the key you manage.
• To read data, the system must unwrap the DEK using the KEK; if the KEK is in your KMS and unavailable, the data cannot be decrypted.

Placing the KEK in a key management system you operate — reached over a standard protocol such as KMIP — gives you three levers: rotation (replace keys on a schedule without re-encrypting all data), access policy (decide which systems may use a key), and revocation. Revoking or destroying a key renders the data it protected permanently unreadable — sometimes called crypto-shredding — a fast, verifiable way to retire data or cut off a compromised system.

Why customer-managed keys matter

Key custody is where several security and compliance goals converge.

• Control over disclosure. If the provider cannot decrypt, a compelled disclosure yields ciphertext, not readable information — the point at which encryption becomes meaningful for data sovereignty.
• Separation of duties. No single party holds both the data and the means to read it, which aligns with zero-trust principles and satisfies auditors who look for that split.
• Insider and supply-chain risk. A compromised provider account or administrator cannot read data whose key sits in your KMS.
• Verifiable retirement. Destroying the key is a clean, provable way to make data unrecoverable without hunting down every copy.

These are the reasons frameworks in finance, healthcare and the public sector increasingly ask not merely whether data is encrypted, but who holds the keys.

Customer-managed keys and ARTESCA

Scality ARTESCA is built so that the storage platform never holds both your data and the keys to read it.

• AES-256 at rest. Data is encrypted with AES-256, and encryption can be enabled at the bucket level so every object in a bucket is covered.
• Keys off the array. Encryption keys are held in an external, KMIP-compatible key management system rather than on ARTESCA itself, so no encryption credentials live alongside the data.
• Broad KMS support. Because ARTESCA speaks the standard KMIP protocol, it works with a wide range of third-party key managers you already operate.
• Zero-trust by design. Separating keys from storage means no single system holds both, reinforcing the separation of duties described above.

The result is customer-managed encryption you actually control: you run the key manager, you set rotation and revocation, and the same data can be made immutable through S3 Object Lock, so it is confidential and protected against ransomware at once.

Customer-managed keys FAQs

What is the difference between customer-managed and provider-managed keys?

Provider-managed keys are generated and held by the provider, which can therefore decrypt your data. Customer-managed keys are controlled by you — you set rotation, access and revocation — so the provider can only decrypt while your key is available to it.

Is CMK the same as BYOK?

Not exactly. CMK is the general idea of the customer controlling the key lifecycle. BYOK is a specific pattern where you generate key material and import it into the provider's key service. HYOK goes further, keeping the key entirely in your own KMS.

What is envelope encryption?

A two-tier scheme where data is encrypted with a data encryption key (DEK), and the DEK is encrypted by a key encryption key (KEK) that you manage. Reading data requires unwrapping the DEK with the KEK, so control of the KEK controls access.

What happens if I lose or revoke my key?

Data protected by that key becomes unreadable. This is a risk to manage with backups and key-rotation discipline, but it is also a feature: destroying a key is a fast, verifiable way to make data unrecoverable, known as crypto-shredding.

Does KMIP matter for customer-managed keys?

Yes. KMIP is a standard protocol for talking to key managers, so a storage system that supports it can use the KMS you already run rather than locking you into one vendor's key service.