Can you see our data?
- Date
- By
- CipherStash Team
No. A data key is derived inside your application from two inputs: an authority key held in ZeroKMS and a client key held by you. ZeroKMS returns a seed that is useless without your client key, and plaintext never leaves your process. What we cannot yet offer is running without us. Today, deriving a key still requires ZeroKMS to participate.
With a conventional cloud KMS the provider holds the master key. An authorized decrypt call returns plaintext, and what stands between the provider and your data is their access policy.
ZeroKMS splits the key. Every value has its own data key, derived in your application from an authority key that lives in ZeroKMS and a client key that lives in your environment and never leaves it. ZeroKMS produces a seed from the authority key. Your application combines the seed with the client key. The two halves are never in the same place.
So the most CipherStash can do, with full access to our own infrastructure, is produce seeds. Without your client key a seed does not become a key. Encryption and decryption run in your process, so plaintext never reaches us either. An attacker would need both halves, from two different environments, to derive a data key.
What this does not cover
It does not make you independent of us. Key derivation needs ZeroKMS to participate, today. Key export, which would let you hold both halves and derive keys offline, is in development and has not shipped. If you want to leave, you decrypt during your notice period, and decryption is never charged. Enterprise agreements can add a guaranteed wind-down period and source code escrow. There is a separate note on that.