Encryption and keys
Originals, events, reports, basemaps, the audit log and backups are all encrypted with a key you hold in your own key management service. Disable the key and stored originals become unreadable, to Foxborne as much as to anyone.
On this page7
Holding the key yourself means you decide who can read the evidence, Foxborne included. Every store in a deployment is encrypted with a customer-managed key. The key stays in your key management service and rotates on your schedule.
The example deployment runs in AWS GovCloud, so its key lives in AWS KMS, and this page follows that example. In any cloud account, Azure Government included, originals stay in your storage, encrypted with your keys.
Before you start#
- You need the Admin role. Only admins hold Manage hosting, keys and access.
- You can view the key in your key management service, such as the AWS KMS console for the deployment's account.
Check the key#
Open the Encryption key panel
Go to Hosting. The Encryption key panel names the key.
- Key
- alias/foxborne-evidence
- ARN
- arn:aws-us-gov:kms:us-gov-west-1:123456789012:key/6f0d2c1a-9b4e-4c8a-a1f7-3e52d09b7c41
- Custody
- AWS KMS, FIPS 140-3 validated HSMs
- Rotation
- Yearly, automatic, last on 30 Jun 2026
These are example values. Custody describes AWS KMS: the FIPS 140-3 validation belongs to the hardware security modules of AWS KMS, not to Foxborne.
Find the same key in your KMS
In your key management service, find the key by the alias or the ARN from the panel. The ARN also names the region and the account that hold the key.
Confirm automatic rotation
In AWS KMS, check that automatic key rotation is turned on for this key. The Rotation line reports the schedule and the last rotation. Rotation happens in your KMS: the panel has no buttons, and Foxborne has no rotation control of its own.
Check which stores use it
On Hosting, the Where each kind of data lives table gives the encryption of every store. Each row names the customer key.
What the key protects#
| Data | Location in the example | Encryption |
|---|---|---|
| Original files | s3://hfr-foxborne-originals | SSE-KMS, customer key |
| Normalized events and notes | PostgreSQL 16 in vpc-0c41e9 | Storage encrypted with the customer key |
| Reports and case files | s3://hfr-foxborne-exports | SSE-KMS, customer key |
| Basemaps and elevation | s3://hfr-foxborne-basemaps | SSE-KMS, customer key |
| Audit log | Append-only table, streamed to your SIEM | Customer key |
| Backups | AWS Backup vault hfr-foxborne | Customer key |
SSE-KMS is Amazon S3 server-side encryption with a KMS key. The Data boundary panel on the same page draws the key inside your account, as Customer-managed key.
If you disable or revoke the key#
The evidence goes dark with the key
Disabling this key makes every stored original unreadable, to Foxborne as much as to anyone. Stored originals and exports become unreadable, including to Foxborne.
That is the control a customer-managed key gives you: you can cut off access to the evidence without touching Foxborne. In AWS KMS, a disabled key can be enabled again, while a deleted key cannot be recovered. Treat deleting the key as destroying everything it protects.
Check the result#
- The alias and ARN on the panel match the key in your KMS.
- The Rotation line reads automatic, with a last rotation within the past year.
- Every row of Where each kind of data lives names the customer key.
Troubleshoot#
The last rotation is more than a year old. Check that automatic rotation is still turned on for the key in your KMS.
Stored originals will not open. Check the key's state in your KMS. A disabled key leaves every stored original unreadable until someone enables it again.
Next#
- Security model shows where the key sits in the deployment.
- Retention, holds and redaction covers how long each store keeps its data.
- Backups and recovery covers the backup vault the key also protects.