# Encryption and keys

URL: /security/keys

Originals, events, reports, basemaps, the audit log and backups are all encrypted with a key you hold in your own key management service. Disable the key and stored originals become unreadable, to Foxborne as much as to anyone.



Holding the key yourself means you decide who can read the evidence, Foxborne included. Every store in a deployment is encrypted with a customer-managed key. The key stays in your key management service and rotates on your schedule.

The example deployment runs in AWS GovCloud, so its key lives in AWS KMS, and this page follows that example. In any cloud account, Azure Government included, originals stay in your storage, encrypted with your keys.

## Before you start [#before-you-start]

* You need the **Admin** role. Only admins hold **Manage hosting, keys and access**.
* You can view the key in your key management service, such as the AWS KMS console for the deployment's account.

## Check the key [#check-the-key]

<Steps>
  <Step title="Open the Encryption key panel">
    Go to **Hosting**. The **Encryption key** panel names the key.

    <Fields>
      <Field name="Key">
        alias/foxborne-evidence
      </Field>

      <Field name="ARN">
        arn:aws-us-gov:kms:us-gov-west-1:123456789012:key/6f0d2c1a-9b4e-4c8a-a1f7-3e52d09b7c41
      </Field>

      <Field name="Custody">
        AWS KMS, FIPS 140-3 validated HSMs
      </Field>

      <Field name="Rotation">
        Yearly, automatic, last on 30 Jun 2026
      </Field>
    </Fields>

    These are example values. **Custody** describes AWS KMS: the FIPS 140-3 validation belongs to the hardware security modules of AWS KMS, not to Foxborne.
  </Step>

  <Step title="Find the same key in your KMS">
    In your key management service, find the key by the alias or the ARN from the panel. The ARN also names the region and the account that hold the key.
  </Step>

  <Step title="Confirm automatic rotation">
    In AWS KMS, check that automatic key rotation is turned on for this key. The **Rotation** line reports the schedule and the last rotation. Rotation happens in your KMS: the panel has no buttons, and Foxborne has no rotation control of its own.
  </Step>

  <Step title="Check which stores use it">
    On **Hosting**, the **Where each kind of data lives** table gives the encryption of every store. Each row names the customer key.
  </Step>
</Steps>

## What the key protects [#what-the-key-protects]

| Data                        | Location in the example                  | Encryption                              |
| --------------------------- | ---------------------------------------- | --------------------------------------- |
| Original files              | `s3://hfr-foxborne-originals`            | SSE-KMS, customer key                   |
| Normalized events and notes | PostgreSQL 16 in `vpc-0c41e9`            | Storage encrypted with the customer key |
| Reports and case files      | `s3://hfr-foxborne-exports`              | SSE-KMS, customer key                   |
| Basemaps and elevation      | `s3://hfr-foxborne-basemaps`             | SSE-KMS, customer key                   |
| Audit log                   | Append-only table, streamed to your SIEM | Customer key                            |
| Backups                     | AWS Backup vault `hfr-foxborne`          | Customer key                            |

SSE-KMS is Amazon S3 server-side encryption with a KMS key. The **Data boundary** panel on the same page draws the key inside your account, as **Customer-managed key**.

## If you disable or revoke the key [#if-you-disable-or-revoke-the-key]

<Callout type="danger" title="The evidence goes dark with the key">
  **Disabling this key makes every stored original unreadable, to Foxborne as much as to anyone.** Stored originals and exports become unreadable, including to Foxborne.
</Callout>

That is the control a customer-managed key gives you: you can cut off access to the evidence without touching Foxborne. In AWS KMS, a disabled key can be enabled again, while a deleted key cannot be recovered. Treat deleting the key as destroying everything it protects.

## Check the result [#check-the-result]

* The alias and ARN on the panel match the key in your KMS.
* The **Rotation** line reads **automatic**, with a last rotation within the past year.
* Every row of **Where each kind of data lives** names the customer key.

## Troubleshoot [#troubleshoot]

**The last rotation is more than a year old.** Check that automatic rotation is still turned on for the key in your KMS.

**Stored originals will not open.** Check the key's state in your KMS. A disabled key leaves every stored original unreadable until someone enables it again.

## Next [#next]

* [Security model](/security) shows where the key sits in the deployment.
* [Retention, holds and redaction](/security/retention) covers how long each store keeps its data.
* [Backups and recovery](/deploy/backup-and-restore) covers the backup vault the key also protects.