Key management
Data keys and key-encryption keys, with policy for decrypt and rotation.
Two layers
The key that locks the column value is the data key (DEK). The DEK is stored wrapped by a key-encryption key (KEK). Plaintext DEKs are not left in the database.
Replacing a KEK re-wraps DEKs without rewriting column data. Replacing a DEK re-encrypts the column, and reads continue during that pass.
Policy
A policy names the key, table, column, principal (role or service account), allowed operations, and rotation. Schedules are 30, 60, 90, 180, or 365 days, or a manual rotation. Manage policies from the CLI, the dashboard, or the REST API.
Audit and export
Creating, rotating, or revoking a key, changing a policy, and encrypting or decrypting a value are written to the audit log. Key bytes are not exported. Metadata such as name, algorithm, status, and schedule is.
An externally created KEK can be imported. The manual also describes a self-hosted key store for networks that do not send data outside.