Overview
Encryption is used to secure data by replacing plain text with ciphered text, so that only the intended recipient can understand its contents. Any form of data is initially encrypted at rest using Data Encryption Keys (DEK). The DEKs are further encrypted with Key Encryption Keys (KEK) for an added level of security. The encrypted DEKs are stored in our in-house Key Management Service (KMS), while the KEKs generated are stored in a separate Master server. Learn more about our Encryption and Key Management from our whitepaper.
Bring Your Own Key (BYOK) is a feature that allows you to use your own key encryption key(KEK) instead of Zoho's KEK. You can add a key either from an External Key Manager (EKM) of your choice or upload an encrypted key manually.
If you choose to provide access to your own KEK from an External key manager, it will be used to encrypt or decrypt the DEKs we provide. This ensures that the data security rests in your control, thus enhancing the security of your organization.
The process is as follows:
After you configure your key in Zoho One, we will send a request to your EKM to have our DEKs encrypted.
The encrypted DEK returned from the EKM will be stored in our in-house KMS.
To decrypt the encrypted DEK, we will send a decrypt request to your EKM using the stored ciphered text and receive plain DEK.
The plain DEK will be cached only for the duration allowed by you, after which we will send encrypt/decrypt requests to EKM again, repeating the entire process.
If you choose to upload a key, the process is as follows:
In accordance with our standard practice, data will be encrypted using a DEK managed by us and stored in our KMS. The DEK will further be encrypted using our KEK, which will be stored on a separate server.
To upload your KEK, you will be required to extract the public key from a certificate we provide, which you will then use to encrypt and hash your key.
Upload the encrypted KEK and hashed KEK in Zoho One.
We will decrypt the DEK using our KEK to obtain plain DEK.
This plain DEK will now be encrypted using the KEK provided by you.
You can configure a key for each application individually, group two or more applications, or configure a single key for all the applications in your organization.
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
Create. Review. Publish.
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
Zoho Sheet Resources
Zoho Forms Resources
Zoho Sign Resources
Sign, Paperless!
Zoho TeamInbox Resources
Design. Discuss. Deliver.
Related Articles
Add key from an External Key Manager
Overview Bring Your Own Key (BYOK) is a feature that allows you to use your own key encryption key(KEK) instead of Zoho's KEK. You can add a key either from an External Key Manager (EKM) of your choice or upload an encrypted key manually. If you ...Upload Key
Overview Bring Your Own Key (BYOK) is a feature that allows you to use your own key encryption key(KEK) instead of Zoho's KEK. You can add a key either from an External Key Manager (EKM) of your choice or upload an encrypted key manually. If you ...Edit, Change and Delete key
The steps to edit, change, and delete key vary between the two User Interface versions supported in Zoho One. Select the UI version you use from the tabs below and proceed with the steps that follow. Spaces UI Unified UI Spaces UI Change Key: Sign in ...Encryption at Zoho One
Encryption is primarily used to safeguard the contents of a message so that only the intended recipient can read it. This is done by replacing the contents with unrecognizable data, which could be understood only by the intended recipient. This is ...Device Management - Overview
When it comes to ensuring that your employees are handling corporate data responsibly, managing their devices is just as important as managing their online identities. This aspect of resource management is called Mobile Device Management (MDM). Zoho ...