Data and keys

Encrypt/Decrypt API

Plaintext is sent to Encryption Gateway for encryption and returned by Encryption Gateway after decryption. BYOK does not mean the gateway never handles plaintext.

The customer’s cloud KMS key protects the root used to encrypt their data. Raw KMS key material is not returned to your application.

Each ciphertext is tied to its cryptographic context, including the Alien workspace, project, customer or deployment, and keyId. Changing that context causes decrypt to fail.

Virtual Keys

With an AWS Virtual Key, your application or AWS resource talks to AWS KMS. AWS KMS calls Alien through XKS for cryptographic operations. This is a different data path from the public Encrypt/Decrypt API.

Revocation

The Encrypt/Decrypt API caches a loaded encryption root for five minutes. If the customer disables the KMS key or removes access, requests may continue to use that cached root until it expires. After expiry, Alien must load the root through the customer’s KMS again; that load fails while access remains disabled.

first request       Alien loads the root through the customer's KMS
next five minutes   requests may use the cached root
cache expires       Alien asks the customer's KMS again
access disabled     that reload fails

Existing ciphertext remains in your storage. Revoking access does not delete it.

Design and test your product’s behavior for that state. Do not describe revocation as instantaneous, deletion, or permanent inaccessibility.

Application responsibilities

• Keep the Alien API key in server-side secret storage.
• Derive the customer ID from authenticated tenant context.
• Use stable, intentional keyId values.
• Store ciphertext, not plaintext, after encryption.
• Do not log plaintext, decrypted responses, API keys, or customer credentials.