Encryption
Every file and mail item is encrypted with AES-256-GCM before it's written to your storage account. Anyone with direct access to your Azure or S3 bucket sees only ciphertext.
Algorithm
- AES-256-GCM for content encryption, with a random IV generated per chunk — IVs are never reused.
- GCM’s authentication tag provides built-in integrity checking on decrypt.
- A SHA-256 checksum of the plaintext is stored alongside each blob, checked again on every restore.
Per-tenant key derivation
Each tenant’s encryption key is derived from one shared master key using HKDF (HMAC-based key derivation), with the tenant’s own ID mixed into the derivation. The same master key combined with a different tenant ID produces a different 256-bit key.
Not customer-held keys
This is a real limitation worth stating plainly: tenant keys are derived from a single master key that BYOVault controls, not independent keys you hold or generate yourself. This is not a bring-your-own-key (BYOK) or customer-managed-key model. See Key Management for how the master key itself is stored.
What this protects against
Because encryption happens before data is written to your storage account, someone with read access to the bucket or container itself — including via the cloud provider’s own tools — sees only encrypted ciphertext, never readable file content.