Customer-managed keys
Encrypt customer data with a key they control.
Give them a cryptographic kill switch for their data.
Their data stays in your database. The encryption key stays in their cloud. If they disable it, nothing in your cloud can read their data. That is what enterprises ask for.
Win enterprise customers without deploying into their cloud.
Unreadable without their key.
Buyers fear that your engineers, or an attacker, can read their data. Encrypting it with a key they control lets them shut off access to it whenever they decide.
Your product stays SaaS.
For many enterprise security teams, a key they control is all they need. No single-tenant deployment, nothing to install or run, one product for everyone.
import { encrypt, decrypt } from "./encryption-gateway"
async function saveEmail(customer, email) {
- const body = email.body
+ const body = await encrypt(customer.id, "email-content", email.body)
await db.emails.insert({ customerId: customer.id, body })
}
async function readEmail(customer, id) {
const row = await db.emails.get(id)
- return row.body
+ return decrypt(customer.id, "email-content", row.body)
}
Virtual Keys
What about WHERE, ORDER BY, and indexes?Encrypt the whole database, not the column. Every query keeps working.
SELECT e.id, e.subject, d.filenameFROM emails eINNER JOIN documents d ON d.email_id = e.idWHERE e.customer_id = $1 AND e.created_at > now() - interval '30 days'ORDER BY e.created_at DESCLIMIT 50;
emails_customer_created_idx1.84 ms- Your applicationqueries unchanged
- PostgreSQLindexes and joins unchanged
- Storagepages, WAL, snapshots, replicas · encrypted
- Virtual Keyan ordinary KMS key
- Their keybacks the Virtual Key
Alien lets you encrypt entire AWS resources, like Aurora databases, S3 buckets, and DynamoDB tables, not just columns. The encryption happens at the storage layer, so every query, index, and join keeps working.
The key is a virtual KMS key in your account, backed by your customer’s own key.
How Virtual Keys workIntegrate it tonight.Use it from your code or from your AWS account.
1const encrypted = await fetch("https://encryption.alien.dev/v1/encrypt", {2 method: "POST",3 headers: {4 Authorization: `Bearer ${process.env.ALIEN_ENCRYPTION_KEY}`,5 "X-Alien-External-ID": customer.id,6 "Content-Type": "application/json",7 },8 body: JSON.stringify({9 key: { keyId: "email-content" },10 plaintext: Buffer.from(email.body).toString("base64"),11 }),12}).then((res) => res.json())1314await db.emails.insert({ customerId: customer.id, body: encrypted.ciphertext })Charge for it.Key management is an enterprise line item everywhere else.
Put it on the enterprise tier.
Buyers already budget for it. Add the row to your pricing page, and the feature behind it is one integration.
- Unlimited projects
- SSO
- Priority support
- SAML SSO and SCIM
- Audit log
- Customer-managed encryption keysnew
- Dedicated support
Your buyer already pays for it elsewhere.
Slack, Zoom, Box, Figma, OpenAI, and Anthropic sell key management as an enterprise add-on. Their security team has the question ready.
- SlackEnterprise Key ManagementEnterprise Grid
- ZoomCustomer Managed Keypaid add-on
- BoxKeySafeadd-on
- FigmaEnterprise Key ManagementGovernance+ add-on
- OpenAIEnterprise Key Management2026
- AnthropicCustomer-managed encryption keys2026
Everything around the key.
Fast enough for every read and write.
Calling the customer’s KMS for every record costs hundreds of milliseconds. The gateway does the cryptography in your cloud, in about 4 ms.
How the cache worksAlien loads their key once and keeps it in memory for five minutes. Every read and write after that is local.
Their security team sets it up themselves.
A guided flow in your branding, with the exact steps for AWS KMS, Google Cloud KMS, and Azure Key Vault. No call, no ticket to you.
See customer setupConnect your encryption key
Choose the key service that will protect your organization’s data.
- You grant
- Encrypt and Decrypt on one KMS key in your AWS account
- Set up with
- CloudFormation
- Key
alias/acme-prod-data
Your key stays in your cloud. Your product never receives it.
Know the moment a key goes away.
Alien checks every customer’s key on a schedule. If a customer disables theirs, you get an alert before their users see an error.
Test revocation firstcustomer-5-prod in Google Cloud KMS · decrypts for this tenant failKey enabled againLogs for every operation.
Every encrypt and decrypt is logged with its status, customer, key ID, and latency. The plaintext and the ciphertext are never written to the log.
Diagnose operationsOne line per operation. Plaintext and ciphertext are never recorded.
Run it in your cloud.
Install it yourself and no plaintext passes through Alien.
What their security team asks.
Who holds the encryption key?
They do. It lives in their AWS KMS, Google Cloud KMS, or Azure Key Vault and never leaves. Alien holds a wrapped copy of a per-customer root key for five minutes at a time, and nothing on disk in your cloud can decrypt their data.
If you get breached, is our data exposed?
No. Their rows are ciphertext under a key that never left their cloud. A leaked snapshot of your database is unreadable without it.
How do we see what happens to our data?
In their own audit log. Every unlock of the key is a KMS call in their account, so they never have to take your word for it.
What happens to our data when we leave?
They disable the key, and every copy in your cloud becomes unreadable, backups included. There is no deletion process for them to audit.
Connect your first customer’s key.
Connect a test key from a cloud account you control, encrypt one value, and watch decrypt fail once the key is disabled. Then send the questionnaire back.