Key Management

​

Key management modes

Key Management is available under Security → Key Management. Only users with the Owner or Security Officer role can access this section.

---

​

Prerequisites

Before connecting a KMS:

• Owner or Security Officer role in Enclave
• Network connectivity between your Enclave deployment and the KMS endpoint (relevant for private-cloud and on-premise deployments)

For provider-specific prerequisites see the individual provider pages linked below.

---

​

Key ownership & least-privilege permissions

Enclave is use-only: it wraps and unwraps file DEKs with your keys, but it never creates, disables, rotates, or deletes a key in your KMS. You create keys in your own KMS console (setting their key policy, rotation schedule, and grants) and adopt them into Enclave. Your KMS custodian owns the full key lifecycle — this is the separation of duties auditors expect (SOC 2, ISO 27001, PCI DSS). Because Enclave never manages key state, the credentials you grant it can be scoped to the minimum needed to encrypt and decrypt:

---

​

BYOK Connections

The BYOK Connections tab lists all KMS connections configured for your organisation. Click a connection name to view its provisioned keys and connection details.

​

Adding a connection

1. Navigate to Security → Key Management → BYOK Connections
2. Click Add KMS Connection
3. Select a provider and fill in the required fields
4. Click Save — Enclave stores the configuration and runs an automatic connection test

​

Connection statuses

Use the Test Connection button on any row to re-verify at any time.

​

KMS providers

​

Disabling and deleting connections

• Disable — stops Enclave from using the connection for new operations. Existing encrypted data is unaffected.
• Delete — permanently removes the connection. Enclave will block deletion if any files are still encrypted under this KMS. Migrate or delete those files first.

---

​

Platform KMS

The Platform KMS tab shows KMS connections managed by the Kvelden platform team on behalf of your organisation, backed by Kvelden’s HSM infrastructure. A platform KMS appears here — and becomes selectable in your Encryption Policies — only once the platform team has provisioned a dedicated key for your organisation. Until then, no platform KMS option is shown.

​

How it works

• Once provisioned for your organisation, the platform KMS remains available even after you add your own BYOK connection, and stays visible under this tab.
• You cannot disable or delete a platform KMS connection — these are managed exclusively by the Kvelden platform team.
• Adding a BYOK connection does not deactivate the platform KMS. Files uploaded before BYOK was configured remain wrapped under the platform key until you run a DEK Key Migration to move them.

​

What it protects

Platform KMS keys wrap the DEKs of all files that do not yet have a BYOK encryption policy applied. This ensures every file in your vault has a valid key wrapping layer from day one, even before any BYOK configuration is in place.

​

Coexistence with BYOK

Platform KMS and BYOK connections operate side by side. Once you configure a BYOK connection and set an encryption policy, new file uploads use your BYOK key. Existing files continue to use the platform key until migrated. You control the migration timeline — see DEK Key Migration.

---

​

Provisioned Keys

Each BYOK KMS connection can have one or more CMKs (Customer Managed Keys) registered against it. A provisioned key is a reference to a specific key ID in your external KMS — Enclave uses it to wrap and unwrap file DEKs. Click any connection name in the BYOK Connections table to open the Connection Detail page, which shows:

• Connection metadata (protocol, org unit, creation date, connection ID)
• All provisioned keys for that connection, along with their current health status

​

Provisioning a key

Provisioning adopts a key you already created in your KMS — Enclave does not create keys. Create the CMK in your AWS KMS / CipherTrust console first, grant it the use-only permissions above, then:

1. Click Provision a Key
2. Provide either identifier (Enclave resolves and validates the other against your KMS):

At least one of Key Name / Key ID is required. For Thales the Name is authoritative and rotation-safe: the current version’s name is always stored so a later rotation is followed automatically.

3. Click Adopt Key — Enclave validates the key with a test wrap/unwrap and registers it

​

Key Health Check

The Run Health Check button on the connection detail page performs a live wrap-and-unwrap test against every provisioned key in that connection, in sequence. Use this to verify your KMS is reachable and that all keys are operational before a file operation or a scheduled audit. Running a check

1. Open the connection detail page (Security → Key Management → BYOK Connections → click a connection name)
2. Click Run Health Check
3. Enclave tests each key in turn — a progress indicator is shown per row as the check runs
4. When all keys have been tested, a Health Summary banner appears at the top of the key table

Health states Health Summary banner

​

Health Report

Once a health check has been run, a Download Report button appears alongside Run Health Check. Clicking it generates and downloads a branded PDF health report named kms-health-report-{connection}-{date}.pdf.

​

Removing a key registration

1. Click the Actions menu on the key row
2. Select Remove Key Registration

---

​

Encryption Policies

Encryption Policies is a dedicated tab within Security → Key Management that controls which CMK is used for new file encryptions at each scope level. Policies decouple key provisioning from key selection — you can provision many keys across multiple connections and choose precisely which one is active for each scope.

​

Policy table

​

Tenant default key

The top of the Encryption Policies page shows a Tenant Default Key status card:

• Active — a tenant-wide policy is set; all unscoped files use this CMK for new encryptions
• No policy set — new uploads fall back to the Platform KMS until a BYOK policy is assigned

​

Assigning a policy

1. Click Assign Policy
2. Step 1 — Select scope level (Tenant-wide, Domain, or Department) and the KMS connection
3. Step 2 — Pick a specific provisioned key, or leave as First active
4. Click Assign to save

​

Pinned CMK vs First active

​

Key scopes

A department-scoped policy overrides a domain-scoped policy, which overrides the tenant-wide policy.

​

Removing a policy

Click the Delete icon on a policy row to remove it. New encryptions in that scope fall back to the next broader scope policy (or to the Platform KMS if none exists).

---

​

DEK Key Migration

DEK Key Migration lets you re-wrap all file encryption keys from one key or KMS vendor to another key — for example moving from the Platform KMS to your BYOK key, or from AWS KMS to Thales CipherTrust. File content is never re-encrypted or moved. What changes: The wrapped DEK stored for each file (the key wrapping layer only).
What does not change: File ciphertext, storage location, permissions, or metadata. Files remain fully accessible during migration.

​

Running a migration

​

Monitoring progress

​

Pausing, resuming, and cancelling

​

Migration History

Click View History to see all past migrations — route, status, initiated-by, file counts, and duration.

---

​

Key Rotation

Key Rotation re-wraps the data keys of files that are still bound to an older version of a key onto its current version, after you rotate that key in your KMS. Like migration, it re-wraps the DEK only — file content is never touched and files stay readable throughout. Key Rotation currently supports Thales CipherTrust keys provisioned with their Key Name (wrap-by-name). AWS KMS rotates its backing keys automatically and transparently, so no action is required there — AWS keys do not appear in this panel. For the full rotation lifecycle and safety runbook, see Thales CipherTrust → Key rotation.

​

When to use it

After you rotate a key in CipherTrust Manager, Enclave automatically wraps new data with the new version and notifies your Owners and Security Officers. Existing files stay readable on their original versions. Run a rekey when you want to move that existing data onto the current version — for example, before retiring an old key version in CipherTrust Manager.

​

Running a rekey

​

Monitoring, pausing, and history

The Key Rotation panel exposes the same live progress and controls as DEK Key Migration — Rekeyed / In Use / Skipped / Failed counters, an ETA, and Pause, Resume, Retry failed, and Cancel actions. Click View History for past rekeys.

---

​

Required roles