TechPrufer
Get started
SingleStore
SingleStore logoSingleStore · Feature trail

Cloud Database Encryption Keys

1 post · Jun 2026

What this trail covers

SingleStore Helios offers a spectrum of encryption control for data at rest, ranging from platform-managed encryption using cloud provider KMS keys to Customer-Managed Encryption Keys (CMEK) for enhanced data sovereignty and control. CMEK allows customers to supply their own encryption keys via AWS KMS, Azure Key Vault, or GCP KMS, enabling cryptographic erasure and meeting stringent regulatory requirements. The system utilizes envelope encryption where customer-managed keys (KEKs) encrypt data encryption keys (DEKs). This post details the technical architecture, access control, revocation mechanisms, and critical data loss risks associated with CMEK, guiding users on choosing the appropriate encryption model based on their security and compliance needs.

All SingleStore trails
  1. Cloud Database Encryption Keys and CMEK | SingleStoreThis post elaborates on SingleStore Helios's Customer-Managed Encryption Keys (CMEK) offering. It details the technical architecture of envelope encryption using Key Encrypting Keys (KEKs) and Data Encryption Keys (DEKs), emphasizing that SingleStore never directly handles customer keys. It explains how access is managed via cloud provider APIs and the critical implications of key revocation and deletion for data accessibility and sovereignty. The post also provides guidance on deciding between platform-managed encryption and CMEK based on regulatory, contractual, and governance requirements.