How does BYOK work for telcos on Plugsky?

Key facts

Key custody	Customer-managed keys via AWS KMS, Azure Key Vault, HashiCorp Vault or on-prem HSM
Encryption	AES-256 at rest with envelope encryption and per-region KMS; TLS 1.3 in transit
Revocation	Revoking the key cuts access to protected data — a live control you operate
Deployment	Cloud, your VPC, on-prem and air-gapped tiers all support customer key custody
Access control	SSO (SAML 2.0 or OIDC), SCIM provisioning and RBAC at workspace, role and resource level
Audit	Key lifecycle and access events exportable to SIEM (Splunk, Sentinel, QRadar, Datadog)
Scale controls	Scoped keys, RBAC and SIEM-exportable audit for large operational teams
Sovereign options	On-prem and air-gapped tiers for national infrastructure workloads

TL;DR

• Your KMS or HSM holds the master key; revocation becomes a live control you operate.
• Envelope encryption with AES-256 at rest and TLS 1.3 in transit keeps rotation cheap.
• Treat keys as critical assets with dual control, rotation schedules and audit.
• Match the cryptographic boundary to the network boundary for national workloads.
• Start free with plugsky-micro and plugsky-lite; a 14-day full-access trial covers larger models.

How it works, step by step

1. Decide which stores fall under customer-managed keys and name the owner of the key lifecycle.
2. Create the key in your KMS or HSM and reference it from the Plugsky workspace.
3. Rehearse rotation and revocation in staging before any production data is protected.
4. Standardise a custody profile per workload class across the estate.
5. Automate rotation with HSM or KMS redundancy planned before go-live.
6. Feed key lifecycle events into the same monitoring pipeline as network events.

Try it yourself

Open the AI API key security checklist →

BYOK for telcos: what changes

Telcos operate subscriber data, network telemetry and regulated infrastructure at a scale where key custody is an operational discipline, not a project. Encryption keys typically fall under the same controls as other critical assets: dual control, rotation schedules, and evidence for regulators and internal audit.

In practice, bring your own key (BYOK) creates a cryptographic boundary you operate: your KMS or HSM holds the master key, Plugsky uses it through envelope encryption to wrap per-object data keys, and revoking it stops access to everything protected by that key. AES-256 at rest with per-region KMS, TLS 1.3 in transit, and key permissions kept separate from platform administration are the baseline controls.

Architecture and controls

Hold master keys in an HSM or a KMS your security organisation already operates, separate key permissions from platform administration, and automate rotation with redundancy planned in advance. For national infrastructure, use on-prem or air-gapped deployment so the cryptographic boundary matches the network boundary.

Integration pattern and rollout

Standardise custody per workload class — subscriber data, telemetry, internal tooling — and map each class to a deployment tier. Key lifecycle and access events should flow into the same monitoring pipeline as network events, with retention aligned to regulatory requirements.

The engineering work sits around the pipeline: reference the customer key from the workspace, keep the OpenAI-compatible call path unchanged, and automate rotation so it becomes routine rather than an incident. Export key lifecycle events to the same SIEM that receives authentication and admin events, and keep break-glass procedures in version control.

Limits, evidence and cost

BYOK does not resolve lawful-access obligations; those are legal processes to design with counsel. It also does not remove the cost of HSM fleets — plan staffing and disaster recovery for key infrastructure explicitly.

There is no separate line item for customer-managed keys on supported tiers; check the live pricing page for plan detail. The free plan covers plugsky-micro and plugsky-lite with no card, and the 14-day full-access trial lets you test the full capability set before you commit.

Honest comparison

Concern	Plugsky BYOK	Vendor-managed keys	Building in-house
Key custody	Your KMS or HSM; keys separated from platform administration	Vendor KMS and shared control plane	You build and run the whole stack
Revocation	Revoke the key and protected access stops	Usually a vendor support process	You own the runbook
Evidence	Key lifecycle and access events exportable to SIEM	Vendor portal logs	Custom logging pipeline
Operational load	You own key availability, rotation and backups	Vendor owns the lifecycle	You own everything
Time to control	Configuration on supported tiers	Available immediately	Quarters of engineering
Critical-asset controls	HSM or KMS custody with dual control and audit	Varies by vendor	You operate HSM fleets

Frequently asked questions

What does BYOK actually change?

You supply and control the master key through a KMS or HSM while Plugsky performs cryptographic operations with envelope encryption. Revoking your key stops access to protected data, and key operations stay auditable.

Who is responsible when a key is unavailable?

You are. Key availability becomes your availability, so plan KMS or HSM redundancy, break-glass procedures and incident response before go-live.

Does BYOK replace certification or a DPA?

No. It is one technical control. Compliance posture — SOC 2 Type II and ISO 27001 readiness in progress — and contractual terms such as the DPA must be reviewed separately.

How do we manage keys across many workloads?

Standardise custody per workload class, automate rotation with redundancy, and separate key permissions from platform administration. Treat HSM capacity like any other critical asset.

Can key operations be audited?

Yes — key lifecycle and access events are exportable to SIEM, so they can join the same monitoring pipeline as network and security events.

Does BYOK address lawful access requests?

No. Lawful access is a legal process. BYOK controls who holds the keys and provides a revocation lever, but the two must be designed separately with counsel.