ÃÛ¶¹ÊÓƵ

Customer Managed Keys in ÃÛ¶¹ÊÓƵ Experience Platform

Data stored on ÃÛ¶¹ÊÓƵ Experience Platform is encrypted at rest using system-level keys. If you are using an application built on top of Experience Platform, you can opt to use your own encryption keys instead, giving you greater control over your data security.

This document provides a high-level overview of the process for enabling the Customer Managed Keys (CMK) feature in Experience Platform across Azure and AWS, along with the prerequisite information required to complete these steps.

Prerequisites

To enable CMK, your platform’s hosting environment (Azure or AWS) must meet specific configuration requirements:

General prerequisites

To view and access the Encryption section in ÃÛ¶¹ÊÓƵ Experience Platform, you must have created a role and assigned the Manage Customer Managed Key permission to that role. Any user with the Manage Customer Managed Key permission can enable CMK for their organization.

For more information on assigning roles and permissions in Experience Platform, refer to the configure permissions documentation.

Azure-specific prerequisites

For Azure-hosted implementations, configure your Azure Key Vault with the following settings:

AWS-specific prerequisites

For AWS-hosted implementations, configure your AWS environment as follows:

Process summary process-summary

Customer Managed Keys (CMK) is available through ÃÛ¶¹ÊÓƵ’s Healthcare Shield and Privacy and Security Shield offerings. On Azure, CMK is supported for both Healthcare Shield and Privacy and Security Shield. On AWS, CMK is supported only for Privacy and Security Shield and is not available for Healthcare Shield. Once your organization purchases a license for one of these offerings, you can begin the one-time setup process for enabling CMK.

The process is as follows:

For Azure azure-process-summary

Once the setup process is complete for Azure-hosted Experience Platform instances, all data onboarded into Experience Platform across all sandboxes will be encrypted using your Azure key setup. To use CMK, you will leverage Microsoft Azure functionality that may be part of their .

For AWS aws-process-summary

Once the setup process is complete for AWS-hosted Experience Platform instances, all data onboarded into Experience Platform across all sandboxes will be encrypted using your AWS Key Management Service (KMS) configuration. To use CMK on AWS, you will use the AWS Key Management Service to create and manage your encryption keys in alignment with your organization’s security requirements.

Implications of revoking key access revoke-access

Revoking or disabling access to the Key Vault, key, or CMK app in Azure or the encryption key in AWS can result in significant disruptions, that include breaking changes to your Experience Platform’s operations. Once keys are disabled, data in Experience Platform may become inaccessible, and any downstream operations that rely on this data will cease to function. It is crucial to fully understand the downstream impacts before making any changes to your key configurations.

To revoke Experience Platform access to your data in Azure, remove the user role associated with the application from the Key Vault. For AWS, you can disable the key or update the policy statement. For detailed instructions on the AWS process, refer to the key revocation section.

Propagation timelines propagation-timelines

After key access is revoked from your Azure Key Vault, the changes will propagate as follows:

For example, the Profile dashboard will continue to display data from its cache for up to seven days before the data expires and is refreshed. Similarly, re-enabling access to the application takes the same amount of time to restore data availability across these stores.

Next steps

To begin the process: