Key facts
| Key custody | Customer-managed keys via AWS KMS, Azure Key Vault, HashiCorp Vault or on-prem HSM |
| Encryption | AES-256 at rest with envelope encryption and per-region KMS; TLS 1.3 in transit |
| Revocation | Revoking the key cuts access to protected data — a live control you operate |
| Deployment | Cloud, your VPC, on-prem and air-gapped tiers all support customer key custody |
| Access control | SSO (SAML 2.0 or OIDC), SCIM provisioning and RBAC at workspace, role and resource level |
| Audit | Key lifecycle and access events exportable to SIEM (Splunk, Sentinel, QRadar, Datadog) |
| Key separation | Key permissions separated from platform administration |
| Matter controls | Revoke or destroy keys to enforce boundaries at matter close |
TL;DR
- Your KMS or HSM holds the master key; revocation becomes a live control you operate.
- Envelope encryption with AES-256 at rest and TLS 1.3 in transit keeps rotation cheap.
- The firm holds the cryptographic boundary; revocation follows matter closure.
- Keep indexes and embeddings inside the same boundary as client documents.
- Start free with plugsky-micro and plugsky-lite; a 14-day full-access trial covers larger models.
How it works, step by step
- Decide which stores fall under customer-managed keys and name the owner of the key lifecycle.
- Create the key in your KMS or HSM and reference it from the Plugsky workspace.
- Rehearse rotation and revocation in staging before any production data is protected.
- Choose the key holder and define who can revoke or rotate before loading any matter.
- Scope keys and workspaces per matter so retrieval cannot cross an ethical wall.
- Document key destruction alongside retention rules for matter closure.
Try it yourself
Open the private LLM deployment estimator →
BYOK for legal teams: what changes
Law firms and in-house teams deal in privileged material, and privilege survives only if confidentiality does. Key custody gives the firm its own cryptographic boundary: client data is encrypted under keys the firm controls, and revocation is available when a matter closes or a relationship ends.
In practice, bring your own key (BYOK) creates a cryptographic boundary you operate: your KMS or HSM holds the master key, Plugsky uses it through envelope encryption to wrap per-object data keys, and revoking it stops access to everything protected by that key. AES-256 at rest with per-region KMS, TLS 1.3 in transit, and key permissions kept separate from platform administration are the baseline controls.
Architecture and controls
Separate key permissions from platform administration so no single administrator holds both, and scope keys per matter or system where policy requires it. Pair customer-managed keys with prompt retention settings, access logging and a documented destruction process for matter closure.
Integration pattern and rollout
Set the boundary before the first document is loaded: choose the key holder, define who can revoke, and test the runbook in staging. Keep retrieval pipelines inside the same boundary so embeddings and indexes do not become an unprotected copy of client material.
The engineering work sits around the pipeline: reference the customer key from the workspace, keep the OpenAI-compatible call path unchanged, and automate rotation so it becomes routine rather than an incident. Export key lifecycle events to the same SIEM that receives authentication and admin events, and keep break-glass procedures in version control.
Limits, evidence and cost
BYOK does not create privilege or replace an ethical-walls process, and it does not decide retention — your records policy does. Where a court or regulator demands production, the workflow is legal rather than technical, so design for it explicitly.
There is no separate line item for customer-managed keys on supported tiers; check the live pricing page for plan detail. The free plan covers plugsky-micro and plugsky-lite with no card, and the 14-day full-access trial lets you test the full capability set before you commit.
Honest comparison
| Concern | Plugsky BYOK | Vendor-managed keys | Building in-house |
|---|---|---|---|
| Key custody | Your KMS or HSM; keys separated from platform administration | Vendor KMS and shared control plane | You build and run the whole stack |
| Revocation | Revoke the key and protected access stops | Usually a vendor support process | You own the runbook |
| Evidence | Key lifecycle and access events exportable to SIEM | Vendor portal logs | Custom logging pipeline |
| Operational load | You own key availability, rotation and backups | Vendor owns the lifecycle | You own everything |
| Time to control | Configuration on supported tiers | Available immediately | Quarters of engineering |
| Privilege boundary | Keys scoped to the firm with revocation available | Vendor-managed keys | You operate the boundary |
Frequently asked questions
What does BYOK actually change?
You supply and control the master key through a KMS or HSM while Plugsky performs cryptographic operations with envelope encryption. Revoking your key stops access to protected data, and key operations stay auditable.
Who is responsible when a key is unavailable?
You are. Key availability becomes your availability, so plan KMS or HSM redundancy, break-glass procedures and incident response before go-live.
Does BYOK replace certification or a DPA?
No. It is one technical control. Compliance posture — SOC 2 Type II and ISO 27001 readiness in progress — and contractual terms such as the DPA must be reviewed separately.
Does BYOK preserve privilege?
Privilege is a legal concept, not a cryptographic one. Key custody supports confidentiality by bounding who can read client material, but privilege depends on how that material is handled.
How do we delete client data at matter close?
Combine retention settings with key destruction or revocation, and document which stores — prompts, embeddings and logs — fall inside the matter boundary.
Can we test the firm's custody model?
Yes. Run the pipeline with a test key in staging, rehearse revocation, and confirm that search indexes sit inside the same boundary as the source documents.