Bring Your Own Key (BYOK) for Vaulted Tokenization

Bring Your Own Key (BYOK) replaces ALTR’s managed encryption key with a customer-owned AWS Key Management Service (AWS KMS) key for Vaulted Tokenization data.

What BYOK Replaces

By default, ALTR encrypts Vaulted Tokenization data using an ALTR-owned AWS KMS key. BYOK lets you substitute your own AWS KMS Multi-Region Symmetric key in its place.

Revocation

Revoking ALTR’s access to your KMS key makes all data tokenized under that key permanently unrecoverable.

Caution

Revocation is permanent. After you revoke access, a delay of up to 60 minutes may exist before revocation takes full effect, due to cached key material.

Set Up BYOK

To set up BYOK for Vaulted Tokenization:

1. Generate an AWS KMS Multi-Region Symmetric key in the us-east-1 region.
2. Add an Identity and Access Management (IAM) policy granting ALTR’s AWS account the permissions ALTR needs for tokenization (Decrypt, Encrypt, Re-encrypt, and Generate Data Key). Contact ALTR for its AWS account ID.
3. Create replica keys in the us-east-2 and us-west-2 regions, matching the key policy of the original key.
4. Contact ALTR with your ALTR organization ID and the key Amazon Resource Name (ARN) from us-east-1.