Bring Your Own Key (BYOK) is a feature that allows you to use your own key encryption key(KEK) instead of Zoho's KEK. You can add a key either from an External Key Manager (EKM) of your choice or upload an encrypted key manually. 

If you choose to provide access to your own KEK from an External key manager, it will be used to encrypt or decrypt the DEKs we provide. This ensures that the data security rests in your control, thus enhancing the security of your organization.
The process is as follows:

1. After you configure your key in Zoho Directory, we will send a request to your EKM to have our DEKs encrypted.

2. The encrypted DEK returned from the EKM will be stored in our in-house KMS.

3. To decrypt the encrypted DEK, we will send a decrypt request to your EKM using the stored ciphered text and receive plain DEK.

4. The plain DEK will be cached only for the duration allowed by you, after which we will send encrypt/decrypt requests to EKM again, repeating the entire process.

If you choose to upload a key, the process is as follows:

1. In accordance with our standard practice, data will be encrypted using a DEK managed by us and stored in our KMS. The DEK will further be encrypted using our KEK, which will be stored on a separate server.

2. To upload your KEK, you will be required to extract the public key from a certificate we provide, which you will then use to encrypt and hash your key.

3. Upload the encrypted KEK and hashed KEK in Zoho Directory.

4. We will decrypt the DEK using our KEK to obtain plain DEK.

5. This plain DEK will now be encrypted using the KEK provided by you.

You can configure a key for each application individually, group two or more applications, or configure a single key for all the applications in your organization.