BYOK — Bring Your Own Key
ما هو BYOK?
هذا المصطلح متوفر حاليًا باللغة الإنجليزية فقط.
BYOK (Bring Your Own Key) is a tenant-owned control plane that records which encryption key — held in your external KMS, whether AWS KMS, Google Cloud KMS, Azure Key Vault, or HashiCorp Vault — governs your organization's key-management posture. You register a key reference (an ARN, resource name, or vault path) only; no key material ever leaves your KMS. Auditors use the same concept under the name customer-managed keys (CMK).
More detail
Register a reference, not a key — after you grant Orbit's service identity decrypt access in your KMS, you register the key's identifier (an ARN, resource name, or vault path) and the platform validates it. The key walks one lifecycle, pending to active to revoked, with rotate usable from either live state and revoke closing the entry so only a fresh registration re-opens it. Every register, activate, rotate, and revoke writes an audit-log entry, so the evidence trail an auditor asks for is already on file.
The enforce flag — setting enforce records the key as your organization's governing policy. Platform field-encryption calls that consult BYOK then fail closed with 409 BYOK_KEY_UNAVAILABLE when the key is revoked, unprovisioned, or its wrapped data-encryption key can't be recovered — no silent fallback to the platform key. A ciphertext that can't be resolved on read surfaces as 502 DECRYPTION_FAILED instead.
Scope — BYOK never re-encrypts tenant data, platform-managed encryption stays authoritative for data at rest, and Orbit never mandates a customer-managed key. The distinction auditors care about: platform-managed keys encrypt tenant data with no action from you, while a customer-managed key records your governing key as compliance evidence; one never substitutes for the other.
الأسئلة الشائعة
- Who owns BYOK key rotation?
- You do. Rotation, revocation, and the audit trail are tenant-run controls: you rotate the key in your own KMS and register the rotation with the platform, which counts each rotation against the same reference. Orbit records the evidence; the key itself never leaves your KMS.
- Does BYOK re-encrypt tenant data on the platform?
- No. Platform-managed field encryption stays authoritative for tenant data at rest whether BYOK is configured or not. BYOK records which external key governs your key-management posture as compliance evidence and gates the field-encryption seam that consults it; it is not a re-encryption mechanism.
- Is BYOK required on Devotel Orbit?
- No. Orbit never mandates a customer-managed key. Platform-managed encryption protects tenant data at rest with no action from you; BYOK is an opt-in control for organizations whose compliance program requires them to hold their own key authority.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.