Vault

Each secret stored with Vault uses a unique encryption key and is cryptographically isolated based on user-provided context. Envelope encryption protects data with a data encryption key (DEK), which is then encrypted with a key encryption key (KEK). This approach keeps sensitive data protected while allowing secure key management and access control.

The Enterprise Key Management features of Vault centralize control over encryption keys used for customer data in multi-tenant architectures. EKM streamlines key lifecycle management, access policies, and auditability while integrating with existing applications. Key segmentation by organization, user, or any provided context ensures cryptographic keys are isolated, reducing risk and enforcing access control at business-appropriate boundaries.

Vault supports keys from your own environment or keys linked directly to your customers’ cloud environments. BYOK gives full control over encryption keys while integrating with your security tooling such as cloud SIEMs. Keys stay protected in your custody while enabling secure access for encryption operations, making it suitable for compliance-driven workloads. BYOK integration is available for Amazon Web Services KMS, Google Cloud Compute KMS, Azure Key Vault, and HashiCorp Vault.

Sensitive data in a B2B application is often linked to a specific organization – shared secrets, API keys, OAuth credentials, or application-generated data. Vault protects this information and links each secret with the organization it belongs to, providing full cryptographic separation from other organizations within your application.

User data such as Personally Identifiable Information (PII) or Protected Health Information (PHI) carries strict regulatory requirements including strong encryption, access controls, and data minimization. The risk of mishandling this data is high, both financially and reputationally. Vault stores this data using unique encryption keys without requiring you to manage the complex lifecycle of key hierarchies.

Short-lived dynamic workloads in the cloud make static credentials a significant security risk. Secrets spread across many services make rotation difficult and increase the risk of a leak. Vault encrypts and stores application data such as API keys, database credentials, and PKI certificates in a centralized service and provides them to your application at runtime.