# Can you see our data?

*Published on 2026-10-13T00:00:00.000Z*

*By CipherStash Team*

No. A data key is derived inside your application from two inputs: an authority key held in ZeroKMS and a client key held by you. ZeroKMS returns a seed that is useless without your client key, and plaintext never leaves your process. What we cannot yet offer is running without us. Today, deriving a key still requires ZeroKMS to participate.

## Content

With a conventional cloud KMS the provider holds the master key. An authorized decrypt call returns plaintext, and what stands between the provider and your data is their access policy.

ZeroKMS splits the key. Every value has its own data key, derived in your application from an authority key that lives in ZeroKMS and a client key that lives in your environment and never leaves it. ZeroKMS produces a seed from the authority key. Your application combines the seed with the client key. The two halves are never in the same place.

So the most CipherStash can do, with full access to our own infrastructure, is produce seeds. Without your client key a seed does not become a key. Encryption and decryption run in your process, so plaintext never reaches us either. An attacker would need both halves, from two different environments, to derive a data key.

## What this does not cover

It does not make you independent of us. Key derivation needs ZeroKMS to participate, today. Key export, which would let you hold both halves and derive keys offline, is in development and has not shipped. If you want to leave, you decrypt during your notice period, and decryption is never charged. Enterprise agreements can add a guaranteed wind-down period and source code escrow. There is a [separate note on that](/notes/what-happens-if-you-go-out-of-business).

## Technical evidence

- [Cryptography reference: the key hierarchy](/docs/security/cryptography)
- [Key management concepts](/docs/concepts/key-management)
- [ZeroKMS compared with AWS KMS](/docs/concepts/compare/aws-kms)

## Related notes

- [What happens to our data if you go out of business?](https://cipherstash.com/notes/what-happens-if-you-go-out-of-business.md) — You decrypt it and leave, at no cost from us. Decryption needs ZeroKMS, so plan it inside your notice period. Enterprise agreements can add a guaranteed wind-down period and source code escrow.
- [Is there a network call every time we read a row?](https://cipherstash.com/notes/is-there-a-network-call-every-time-we-read-a-row.md) — One per operation, and a bulk operation shares it. Every KMS needs a network call for key material. ZeroKMS batches, so a page of rows is one request, up to 500 values by default.