[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-envelope-encryption::en":3,"gloss-cluster-envelope-encryption::en":23,"gloss-next-envelope-encryption::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"envelope-encryption","security","Envelope Encryption","Envelope encryption is a two-layer key scheme: you encrypt your data with a fast, per-object data encryption key (DEK), then encrypt that DEK with a separate, well-guarded key encryption key (KEK) held in a key management service (KMS). The encrypted DEK is stored right next to the ciphertext, like a sealed envelope, while the KEK never leaves the KMS. This solves two problems at once — bulk data encryption stays fast because DEKs are symmetric and local, and key rotation becomes cheap because rotating the KEK only re-encrypts the small DEKs, not terabytes of data. It's the pattern underneath most cloud encryption-at-rest and a clean way to implement bring-your-own-key. Practical note: let your KMS generate and wrap DEKs, cache decrypted DEKs briefly in memory to avoid a KMS call per request, scope KEKs per tenant when customers demand isolation, and log every KEK use so you have an audit trail of who decrypted what.","Envelope encryption encrypts data with a per-object key, then encrypts that key with a KMS-held master key — so rotating the master doesn't re-encrypt your data.",null,[11,14,17,20],{"slug":12,"name":13},"audit-log","Audit Log (Audit Trail)",{"slug":15,"name":16},"byok","Bring Your Own Key (BYOK)",{"slug":18,"name":19},"encryption-at-rest","Encryption at Rest",{"slug":21,"name":22},"tenant-isolation","Tenant Isolation",[24,26,30,34,37,40,41,44,47,50,53,56],{"slug":12,"category":5,"name":13,"updated_at":25},"2026-08-24T02:46:37+00:00",{"slug":27,"category":5,"name":28,"updated_at":29},"blast-radius","Blast Radius","2026-08-24T03:30:02+00:00",{"slug":31,"category":5,"name":32,"updated_at":33},"break-glass-access","Break-Glass Access","2026-08-24T02:46:38+00:00",{"slug":35,"category":5,"name":36,"updated_at":33},"bridge-letter","Bridge Letter",{"slug":38,"category":5,"name":39,"updated_at":33},"business-associate-agreement","Business Associate Agreement (BAA)",{"slug":15,"category":5,"name":16,"updated_at":25},{"slug":42,"category":5,"name":43,"updated_at":33},"cve","CVE (Common Vulnerabilities and Exposures)",{"slug":45,"category":5,"name":46,"updated_at":29},"data-classification","Data Classification",{"slug":48,"category":5,"name":49,"updated_at":33},"data-loss-prevention","Data Loss Prevention (DLP)",{"slug":51,"category":5,"name":52,"updated_at":33},"data-minimization","Data Minimization",{"slug":54,"category":5,"name":55,"updated_at":33},"data-poisoning","Data Poisoning",{"slug":57,"category":5,"name":58,"updated_at":33},"data-processing-agreement","Data Processing Agreement (DPA)"]