BYOK (Bring Your Own Key)

When a company stores data with an online service, it is usually stored there encrypted. Encrypting means: the text is made unreadable using a fixed computational procedure. Only someone who possesses the matching secret code, the so-called key, can convert it back. Normally, the provider itself generates and keeps this key. BYOK stands for “Bring Your Own Key,” meaning “bring your own key with you.” The customer then generates the key themselves and retains control over it.

Why companies don’t want to hand over the key

Whoever possesses the key can read the data. If the provider keeps it, the customer simply has to trust them. For vacation photos, that doesn’t matter. For patient records, construction plans, or customer databases, it does. BYOK shifts this question of trust: the provider stores the data but cannot decrypt it without the customer’s involvement.

A second reason is legal in nature. Many European companies are only allowed to store personal data with providers from the USA under strict conditions. Authorities there can, under certain circumstances, demand disclosure. If the key resides in Frankfurt rather than with the provider, access to the hard drive is of little help to the provider. Auditors and data protection officers therefore regularly ask about BYOK.

The third reason is the emergency exit. If the customer deletes or locks their key, all data protected with it becomes immediately unusable. Experts call this crypto-shredding. This is significantly faster and more reliable than deleting millions of files individually and tracking them across all backup copies.

Where the key actually resides

In practice, the customer generates the key in their own key vault. This is a specialized service or a hardened device that stores keys and logs their usage. If the provider needs access to data, its system queries this vault. The vault checks the request and responds with yes or no. Ideally, the key itself never leaves the vault.

Usually, two layers work together here. The actual data is encrypted with a data key, which resides with the provider. This data key is in turn encrypted with the customer’s key. You can picture this like a safe-deposit box: the provider has the key to the box, but that key is kept inside a second small box that only the customer can open. This saves computing time, since only the small box has to go through the vault.

A common misconception is that BYOK completely excludes the provider. That’s not true. During processing, the data must be present decrypted in the provider’s working memory. A provider with very bad intentions, or an attacker within its system, could read it at that moment. BYOK reliably protects against access to data at rest and provides a complete audit trail. For more than that, additional technology such as isolated computing environments is needed.

BYOK in cloud services and AI providers

All major cloud providers offer BYOK, usually through their own key management services. At Microsoft, this offering is called Azure Key Vault; at Amazon, AWS KMS; at Google, Cloud KMS. Services such as Salesforce, Slack, or Dropbox also have corresponding options for business customers. These features are almost always included in the more expensive enterprise tiers.

In the AI field, the term has taken on a second meaning. Many tools let the user enter their own API key. This is an access code for a language model provider such as OpenAI or Anthropic. Requests then run through the user’s own account, and they pay the model provider directly. Providers also call this BYOK, even though here it concerns billing and access rather than encryption.

In the news, BYOK usually appears in connection with digital sovereignty. This refers to the question of who ultimately has control over data and systems. Authorities and corporations in Europe often cite BYOK as a condition for contracts with American providers. A stricter variant is called HYOK, for “Hold Your Own Key”: here, the key never leaves the company’s own infrastructure at all.