Storage Credentials
When you attach your Azure Blob container or S3 bucket, BYOVault needs credentials that can write to it. The following describes exactly how those are held.
Where they live
The credentials themselves — an Azure storage account name and access key, or an AWS access key pair — are held in a dedicated, encrypted secrets store, separate from BYOVault’s application database. BYOVault’s own database only stores the storage type and the container/bucket name — it never stores your credentials, in plaintext or otherwise.
This is the same credential used for every ordinary backup write and restore read against your storage account.
A separate, one-time credential is used only when creating and locking your retention vault’s immutability policy with your cloud provider. BYOVault keeps these two credentials and their validity independent of one another.
What these credentials authorize
Beyond ordinary backup and restore traffic, BYOVault also uses these same credentials to authorize retention-vault moves that stay on a single cloud provider.
- Same-provider primary/vault pair: the file moves directly between your primary account and your vault account on the provider’s own infrastructure, without the content passing through BYOVault’s own servers.
- Primary/vault pair split across providers: the file always moves through BYOVault’s backup service instead.
The full details of each path and which bytes travel where are covered in Data Residency & Data Flow; this page is limited to where the credentials themselves are held.