Encryption (bring your own key)
Your tenant's sensitive data — integration credentials (cloud, licenses, SSO, virtualization, SMTP) and uploaded contract documents — is stored encrypted. You decide with which key.
The two modes
| Mode | Description |
|---|---|
| Use platform key (default) | Contrixt manages the key — no effort on your side |
| Use your own key (BYOK) | You provide the key — accepted: 64 hex characters, a base64 key (32 bytes) or a long passphrase (min. 16 characters) |
Activating your own key
You make the choice in the first-login wizard or any time in the Data encryption card under Administration → Settings:
- Select Use your own key.
- Enter the key — a random 256-bit key is recommended, e.g. via
openssl rand -hex 32. - Click Apply key. Existing data remains readable.
How to verify it works: The card confirms the activation and shows the current key fingerprint — so you can always tell which key is active. The change is also recorded in the audit log (incl. fingerprint).
How it works (envelope encryption)
Every tenant owns a random data encryption key (DEK) that encrypts the actual data (AES-256-GCM). The DEK itself is "wrapped" with your chosen key. This has an important consequence:
Key changes without data loss
On a switch or rotation, only the DEK is re-wrapped — existing encrypted data stays readable without re-encryption. You can safely switch from the platform key to BYOK and back.
Transparency: the escrow model
Contrixt syncs in the background (licenses, cloud costs, VMs) — even when nobody is signed in. For this, the key must be available server-side. Therefore, with BYOK:
- Your key is stored encrypted (under the platform key) on the server so background syncs keep running.
- You retain control over choice and rotation of the key; the fingerprint in the settings makes the active key recognizable.
- Contrixt can technically still decrypt — we communicate this deliberately and openly. BYOK here is a control and compliance instrument, not a zero-knowledge promise.
Recommendations
- Generate the key randomly, e.g.
openssl rand -hex 32. - Keep it in your password/secret manager.
- Rotate the key whenever your security policy requires it — thanks to envelope encryption, without downtime.
Regardless of the chosen mode: TLS for all connections, encrypted storage of all data and tenant isolation at the database level — see Security & audit log.