Multicloud AI & ERP / Cloud & AI Security, Governance & Compliance
Why it matters
Regulators and customers increasingly ask who holds the keys. Customer-managed keys let you revoke access to data, including AI indexes and model files, while secrets services stop credentials leaking through code.
How it works
Envelope encryption
Each piece of data is encrypted with a data key. The data key is itself encrypted with a master key in the key management service, governed by a key policy. Every use is logged, and disabling the master key makes the data unreadable.
AWS, Azure and Google Cloud compared
| AWS | Azure | Google Cloud | |
|---|---|---|---|
| Key management | AWS KMS | Azure Key Vault | Cloud KMS |
| Dedicated HSM | CloudHSM | Managed HSM | Cloud HSM |
| Keys outside the cloud | External key store | Managed HSM, partner options | Cloud External Key Manager |
| Secrets | Secrets Manager | Key Vault secrets | Secret Manager |
| Rotation | Automatic key and secret rotation | Rotation policies | Automatic rotation |
What makes each cloud different
AWS
AWS KMS integrates with almost every service, key policies and grants control use, and the external key store keeps keys outside AWS for the strictest requirements. Secrets Manager rotates credentials automatically.
Azure
Azure Key Vault holds keys, secrets and certificates, Managed HSM provides single-tenant FIPS 140-3 Level 3 hardware, and purge protection stops keys being deleted.
Google Cloud
Cloud KMS supports customer-managed keys across services including Agent Platform, and Cloud External Key Manager with Key Access Justifications lets you approve every use of a key.
Design decisions that matter
- 01Customer-managed keys for sensitive data
Including AI indexes and model artifacts.
- 02Separate key admins from data admins
No single person can do both.
- 03Every secret in a secrets service
Never in code or images.
- 04Automatic rotation
Keys and secrets on a schedule.
Common mistakes we see
- Secrets in environment files. They end up in repositories and logs.
- One key for everything. No way to revoke access selectively.
- Deletable keys. Accidental deletion destroys data.
A practical 30-day plan
- Week 1
Classify data needing customer-managed keys.
- Week 2
Create keys with separated duties.
- Week 3
Move secrets into the secrets service.
- Week 4
Enable rotation and deletion protection.
How NTS helps
NTS designs encryption and secrets management on AWS, Azure and Google Cloud, covering key hierarchies, HSM and external key options, secrets migration and rotation, mapped to your compliance needs.
What you get
- A key management design across clouds
- Customer-managed keys for sensitive data
- Secrets moved out of code into managed vaults
- Rotation and access auditing
Typical outcomes
- No leaked secrets in repositories
- Keys under your control
- Audit-ready encryption evidence
How we work with you
- 1Assess
A focused review of your encryption, keys and secrets across AWS, Azure and Google Cloud. We look for the gaps we find most often: secrets in environment files, one key for everything and deletable keys.
- 2Design
A target architecture and roadmap built on the decisions that matter most: customer-managed keys for sensitive data, separate key admins from data admins, every secret in a secrets service and automatic rotation.
- 3Build
Hands-on delivery alongside your team. We classify data needing customer-managed keys, create keys with separated duties, move secrets into the secrets service, and finally enable rotation and deletion protection.
- 4Run and improve
We automate rotation, review key access and scan continuously for exposed secrets.
Why teams choose NTS for encryption, keys and secrets
- Encryption done right
We cover data at rest, in transit and in use.
- No secrets in code
We remove hard-coded credentials completely.
- Key control for regulators
Customer-managed keys meet strict compliance needs.
Book a free 30-minute review
Talk to an NTS architect about your encryption, keys and secrets on AWS, Azure and Google Cloud.