Key facts
| In transit | TLS 1.3 with HSTS |
| At rest | AES-256-GCM with customer-managed key options |
| BYOK integrations | AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault |
| Dedicated hardware | Thales Luna and AWS CloudHSM supported for HSM custody |
| Key revocation | Customer-controlled rotation and revocation |
| Secret hygiene | API keys hashed at rest with Argon2id and excluded from logs |
| Sovereign option | On-prem and air-gapped deployments for offline key custody |
| Compliance posture | SOC 2 Type II and ISO 27001 readiness in progress (not yet certified) |
TL;DR
- HSMs protect key material; envelope encryption protects the data at scale.
- Decide custody and revocation authority before choosing a vendor.
- BYOK means you revoke; it does not mean the provider cannot see plaintext by design.
- Rotate KEKs on a schedule and test revocation in a rehearsal.
- Air-gapped deployments exist for environments where no external KMS is allowed.
How it works, step by step
- Classify the assets that need encryption and the retention each requires.
- Define a key hierarchy: root key in HSM or KMS, key-encryption keys, per-tenant data keys.
- Choose custody: provider-managed, BYOK to your cloud KMS, or dedicated HSM.
- Define who can use, rotate, disable and destroy each key, and how approvals work.
- Verify the audit trail records every key operation with actor and timestamp.
- Rehearse rotation and revocation, including the blast radius of losing a key.
- Document recovery: escrow, backup keys and the process when a KMS is unavailable.
Original data
Try it yourself
Open the sovereign AI readiness score →
Envelope encryption in one page
You rarely encrypt every request with an HSM-resident key directly; the latency and operation limits make that impractical. Instead, envelope encryption separates concerns:
- Root or key-encryption key (KEK): lives in the HSM or KMS, never leaves it in plaintext.
- Data-encryption keys (DEKs): generated per tenant or per dataset, used with AES-256-GCM, and stored wrapped by the KEK.
- Rewrapping: rotating a KEK re-wraps DEKs without re-encrypting the data, which keeps rotation fast.
This is how prompts, embeddings, logs and backups can share one custody model without a hardware bottleneck on every call.
Choosing custody: KMS, BYOK or dedicated HSM
Three practical levels, in increasing control and operational cost:
- Provider-managed keys: simplest, with the provider operating the KMS. Fine when your threat model does not include the provider.
- BYOK: you import keys into the provider's KMS from AWS KMS, GCP KMS, Azure Key Vault or HashiCorp Vault. You control rotation and can revoke, though operational access is still inside the provider's boundary.
- Dedicated HSM: Thales Luna or AWS CloudHSM for key material that must never exist in software, with quorum controls for destructive operations.
FIPS validation level, quorum approval and key-usage logging are the details that separate a checkbox from a control. Ask which level applies and whether keys are exportable.
Rotation, revocation and the failure you must rehearse
Rotate KEKs on a defined schedule and DEKs with tenant lifecycle events; log every operation. Then rehearse the two failures that matter: a compromised key that must be revoked quickly, and an unavailable KMS that blocks decryption. The first is a process test — can you revoke within your incident SLA, and what stops working? The second is an architecture test — is there an offline path for air-gapped deployments, and can you recover without weakening custody? For regulated workloads, air-gapped installations with physical key custody remove the external dependency entirely, at the cost of manual update logistics.
Where Plugsky fits
Plugsky encrypts in transit with TLS 1.3 and at rest with AES-256-GCM, supports customer-managed keys through AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, Thales Luna and AWS CloudHSM, and hashes API keys with Argon2id. Key rotation and revocation stay with you under BYOK, and audit trails capture key operations. Honest limits: completed SOC 2 and ISO 27001 certifications are in progress rather than finished, and dedicated HSM arrangements are enterprise-scoped. Confirm custody details, FIPS levels and revocation procedures with the enterprise team, and reference /legal/terms and /legal/sla for contractual commitments.
Honest comparison
| Model | Provider KMS | BYOK to your cloud KMS | Dedicated HSM |
|---|---|---|---|
| Who operates key material | Provider | Shared — you import, provider uses in its boundary | You, on dedicated hardware |
| Revocation control | Provider process | You revoke unilaterally | You, with quorum controls |
| Operational overhead | Lowest | Moderate | Highest |
| FIPS assurance | Provider-attested | Depends on your KMS | Hardware-validated levels |
| Air-gapped fit | No | No | Yes, with offline custody |
| Best for | Standard SaaS workloads | Regulated data with cloud KMS | Highest-assurance key custody |
Frequently asked questions
Does an HSM replace encryption at rest?
No. The HSM protects key material while AES-256-GCM protects the data. Envelope encryption connects the two: HSM-resident KEKs wrap the data keys that encrypt prompts, vectors and logs.
What is BYOK and what does it actually give us?
Bring Your Own Key lets you import keys from your KMS into the provider's key management, so you control rotation and can revoke. It does not change the provider's operational boundary unless you move to a dedicated HSM or on-prem deployment.
Which HSMs does Plugsky support?
The docs list AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, Thales Luna and AWS CloudHSM for key custody integrations.
Do we need an HSM for GDPR compliance?
GDPR does not mandate HSMs. They help where key custody is part of your risk model or where national frameworks require hardware-backed key protection. Decide from your threat model and sector rules.
What happens if we lose a key?
Data wrapped by a destroyed key is unrecoverable by design. Define escrow, backup and quorum procedures before go-live, and rehearse recovery so the process is real.
Can keys be rotated without downtime?
Yes. Rewrap data keys with the new KEK rather than re-encrypting data, and run rotation as a background operation. Test that in-flight requests keep working during the rotation window.
Are API keys stored in the HSM?
API keys are hashed at rest with Argon2id, not encrypted as data. HSMs protect data-encryption key material for prompts, logs, vectors and backups.
Does Plugsky support air-gapped key custody?
Yes. On-prem and air-gapped deployments ship with offline key custody options, removing external KMS dependencies for environments where no external network path is allowed.