Customer data glossary

Customer-managed keys (key custody)

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

Customer-managed keys are encryption keys the customer creates, controls and can disable or delete, giving the customer, rather than the vendor, final say over who can decrypt its data.

Part of the Learn hub and the customer data glossary.

What it means in practice

The idea is separation: the party that stores your data does not hold the only key to it. AWS describes customer managed keys as KMS keys in your account that you create, own and manage, with full control over key policies, enabling and disabling, rotation and scheduled deletion; AWS managed and AWS owned keys are controlled by the service 1.

Custody models sit on a spectrum. Provider-held keys are the default. Customer-managed keys live in the provider's key service under your policy. Bring-your-own-key imports your key material into that service. External key stores keep the material in a hardware security module you operate. Terminology varies by vendor, so ask where key material physically sits and who can invoke it.

Custody gives practical powers: revoke a vendor's ability to decrypt, log every key use, and make data unreadable by destroying a key ("crypto-shredding"), which supports exit and some deletion workflows. It adds duties too: lose the key and you lose the data, and availability now depends on your key service.

Regulation names encryption without mandating who holds keys. GDPR Article 32(1)(a) lists pseudonymisation and encryption among appropriate measures 2, and HIPAA treats encryption of electronic PHI as an addressable specification (45 CFR 164.312(a)(2)(iv)) 3.

Example (health insurer): a payer keeps member engagement data encrypted under keys in its own HSM-backed key service. If the vendor relationship ends, it revokes the key grant and vendor-side copies become unreadable.

Single-tenant vs multi-tenant: per-customer isolation.
Bring your own cloud (BYOC): keys in your account.
Data sovereignty: key custody is one element.
Audit ledger: records key use.
Self-hosted customer data platform (CDP): keys stay inside.

Where it matters

On-premise, private cloud and self-hosted customer data platforms: the complete guide: key custody options.
Customer data platform on AWS, Azure and GCP: key services by cloud.

Back to the customer data glossary or the Learn hub.

Frequently asked questions

Does HIPAA require customer-managed keys?

No. HIPAA treats encryption as an addressable specification and does not say who must hold keys. Customer-managed keys are one way to meet the outcome of your risk analysis.

What if the vendor's software can use my key?

Then the vendor can decrypt while the grant exists. Custody makes that a revocable permission, not a barrier during operation. Review grants and key-use logs.

Customer-managed keys or BYOK?

Customer-managed keys are created and controlled in a provider's key service. BYOK means you generate the key material and import it. Vendors sometimes use the terms interchangeably, so ask.

Sources

AWS Key Management Service, KMS keys and customer managed keys Open source
Regulation (EU) 2016/679 (GDPR), Article 32 Open source
45 CFR 164.312, technical safeguards Open source

This entry is general information, not legal advice.