BYOK and Encryption
Understand the difference between storage encryption BYOK and true private key self custody with SecuriTLS Satellites.
Overview
SecuriTLS supports two different key control models. Storage encryption BYOK lets Business and Enterprise customers control the wrapping key used to protect a SecuriTLS generated storage DEK. Satellite private key custody keeps private key operations inside the customer environment.
These models can be used together, but they solve different problems. AWS KMS BYOK protects encrypted data at rest. Satellite custody controls where private keys are generated, decrypted, and used.
For the full architecture diagram, see Key Management and Sensitive Material Flow.
Storage encryption
SecuriTLS uses AES-256-GCM encryption when storing private key material in storage providers.
SecuriTLS generates a customer specific data encryption key, or DEK. The DEK encrypts private key material before it is written to Sia or AWS storage.
By default, that DEK is wrapped by a SecuriTLS managed key encryption key, or KEK.
AWS KMS BYOK for storage encryption
Business and Enterprise customers can configure AWS KMS so a customer controlled KMS key wraps and unwraps the SecuriTLS generated storage DEK.
This is storage encryption BYOK. SecuriTLS still generates the DEK, and the DEK is still what encrypts stored private key material. The customer controlled KMS key protects access to that DEK.
If KMS access is removed, SecuriTLS may be unable to unwrap the storage DEK until access is restored or the DEK is rewrapped.
Satellite private key custody
SecuriTLS Satellites are available to Team, Business, and Enterprise plans. A Satellite is a lightweight agent that runs inside your environment and connects outbound to SecuriTLS.
For true private key self custody, key generation, CSR creation, signing operations, decryption, and deployment can happen inside the Satellite environment. In this model, SecuriTLS coordinates lifecycle automation and stores metadata or encrypted blobs, but does not need plaintext private key access.
This is the model to use when private keys should remain under customer control rather than being imported into SecuriTLS custody.
Storage BYOK vs Satellite custody
SecuriTLS managed storage encryption
Available to: Free, Solo, Team, Business, and Enterprise
SecuriTLS generates the storage DEK and wraps it with a SecuriTLS managed KEK.
AWS KMS storage BYOK
Available to: Business and Enterprise
A customer AWS KMS key wraps the SecuriTLS generated storage DEK. This improves customer control over encrypted assets at rest.
Satellite private key custody
Available to: Team, Business, and Enterprise
Private key generation and use can happen inside the customer environment. This is the strongest model for private key self custody.
AWS KMS setup
Business and Enterprise customers can configure a role ARN, key ARN, and optional external ID for KMS integration. The KMS key should be symmetric and support encrypt and decrypt operations.
When AWS KMS is enabled, SecuriTLS uses the configured KMS key to wrap and unwrap the customer storage DEK.
Rewrapping guidance
Before revoking KMS access, rewrap the DEK using another AWS KMS key or the SecuriTLS default KEK. Revoking KMS access before rewrapping may interrupt storage reads, private key retrieval, deployments, and other workflows that depend on encrypted assets.
Satellite availability does not automatically replace storage key access. If a stored encrypted asset depends on a DEK that SecuriTLS cannot unwrap, the asset may remain unreadable until key access is restored or rewrapped.