Ask our Agents

What is this thing, and what will it take?

Name something a big customer asked for, like SCIM, SOC 2 or RBAC. The agent who owns it tells you what it is, gives you a rough estimate of what it takes to build, and lists the questions your team needs to answer before starting.

BYOK

Bring your own key, or customer-managed encryption keys

What it is

BYOK lets a customer control the key that encrypts their data inside your product, usually held in their own AWS KMS, Google Cloud KMS or Azure Key Vault. Your system uses their key to encrypt and decrypt, and if they revoke it, their data becomes unreadable, including to you. It is typically built with envelope encryption: per-tenant data keys, wrapped by the customer's master key.

Banks, healthcare companies and large enterprises want the ability to cut off access to their data, including from their vendors.

What it takes

About 6–12 engineer-weeks to build in-house, or 3–6 using a cloud KMS plus a library such as the AWS Encryption SDK or Tink.

Answer these first

Product: What happens to the product when a customer revokes their key?
Engineering: Which data is encrypted with the customer's key: everything, or specific fields?
Engineering: Which key management services do our buyers use?
Security: How are keys rotated, and who can trigger it?
Sales: Has BYOK already been promised in a contract?
Finance: Is BYOK an enterprise add-on?

This page works best with JavaScript on. Every answer also has its own address, like /what/scim.

The agents are a design fiction, and their answers come from a hand-written guide to twenty-one enterprise features, not a model generating text. Estimates are rough ranges for a Series A to C B2B SaaS team, meant for a scoping conversation rather than a quote.