# Why wouldn't we just build this ourselves with KMS and a hash column?

*Published on 2026-10-13T00:00:00.000Z*

*By CipherStash Team*

You could, and on the licence line it is cheaper. AES on the column and an HMAC next to it for lookups is an afternoon's work. What you would then own is key management, per-value keys, rotation, key history, audit, the production migration, and the cloud KMS bill that per-value keys generate. Price those before comparing.

## Content

## Where building it yourself is enough

Twenty lines of code gives you AES-GCM on a column and an HMAC next to it for equality lookups. If your team accepts the operational model that comes with it, that may be all you need: one key, or a handful, in a secrets manager; rotation done by hand, or never; no per-row audit. Plenty of systems run this way and are fine.

## Where it stops being enough

The costs show up when the requirement changes from "encrypt the column" to "prove who could read it."

- **Per-value keys.** Every value under its own key needs a key service that can hand out keys in bulk. A cloud KMS charges per operation, so per-value keys on AWS KMS become a bill that scales with your row count. ZeroKMS batches that work into one request per batch of up to 500 values.
- **Rotation and key history.** Rotating a DIY key means re-encrypting everything under it and keeping the old key until you have. With ZeroKMS, keys are rotated automatically where rotation is needed, and some need none. The root key protecting ZeroKMS is rotated automatically by AWS KMS. Data keys never need rotating: keys are rotated to limit wear-out and how much data one key protects, and each data key encrypts exactly one value.
- **Audit.** "Who decrypted this value" is a log line your own application writes in the DIY version. With identity-bound keys, a value cannot be decrypted without a key derivation made as that identity, and ZeroKMS records every derivation. The audit trail comes from the key service, outside the application code you would otherwise have to trust.
- **Migration.** Getting from plaintext columns to encrypted ones in production without downtime is a project. The `stash` CLI runs it as a staged backfill.
- **Query support.** Equality is easy to build yourself. Range, ordering and free-text over ciphertext are not.
- **Leaving.** Decryption is free, including a bulk decryption on the way out.

## The comparison to run

Price the cloud KMS operations your row count implies, add the engineering to build, operate and audit the rest, and compare that with the pricing page. For some teams the DIY number still wins. Get the number first.

## Technical evidence

- [Pricing](/pricing)
- [ZeroKMS compared with AWS KMS](/docs/concepts/compare/aws-kms)
- [Key management concepts](/docs/concepts/key-management)

## Related notes

- [What happens to our data if you go out of business?](https://cipherstash.com/notes/what-happens-if-you-go-out-of-business.md) — You decrypt it and leave, at no cost from us. Decryption needs ZeroKMS, so plan it inside your notice period. Enterprise agreements can add a guaranteed wind-down period and source code escrow.
- [Is there a network call every time we read a row?](https://cipherstash.com/notes/is-there-a-network-call-every-time-we-read-a-row.md) — One per operation, and a bulk operation shares it. Every KMS needs a network call for key material. ZeroKMS batches, so a page of rows is one request, up to 500 values by default.