FAQs-Supporting User Master Key

The cloud connector facilitates all communication and interactions between AppViewX and the User's resources, which includes the Hardware Security Module (HSM).

Yes. The communication between AppViewX and the AppViewX cloud connector is through a TLS-encrypted channel.

The AppViewX cloud connector is required for any communication with the HSM. If there are issues between AppViewX and the AppViewX cloud connector, it can result in a service disruption. To ensure high availability, it is recommended to deploy multiple cloud connectors across various data centers and also ensure that all deployed cloud connectors can interact with the HSM.

AppViewX uses envelope encryption to enhance the security of confidential data. This technique involves encrypting the AppViewX Master Key with the User's Master Key, thus allowing the User to retain control over their data. To ensure the security of the AppViewX Master Key, AppViewX never stores it in plain text format and instead uses AWS KMS to encrypt it. When the user opts to encrypt the AppViewX Master Key, all existing keys of that tenant in the KMS are discarded, rendering any previous data backups useless. The tight security measures in place eliminate the need for rotating the AppViewX Master Key, saving the cost and effort of re-encrypting all secure materials.

In the event that the Master Key is removed, AppViewX will be in a near-read-only state, where only non-sensitive data, such as audit logs, can be viewed. Any actions requiring access to sensitive information will be disabled, even for a local user without multi-factor authentication. This added layer of security ensures the protection of confidential data and reinforces AppViewX's commitment to data privacy and security.

AppViewX conducts regular health checks on the HSM where the User Master Key is stored. In the event that the HSM is deemed unhealthy after three consecutive failures, AppViewX will flush the plain text AppViewX MEK from its cache. This measure is necessary to protect the confidentiality of the data, but it may result in a temporary service disruption.

When enabling the AppViewX MEK encryption, users can set up notifications for the health of the Hardware Security Module (HSM). By configuring a list of email addresses, users can stay informed about the status of the HSM.

Yes AWS KMS is highly available within an AWS region.

No. After enabling AppViewX MEK encryption there is no option to revert back to using the AWS KMS. We can switch the HSM that stores the User's Master Key.

Currently, we do not support the rotation of the User Master Key.

Yes, the Master Key stored in the AWS KMS is rotated every 90 days.

Algorithm: AES

Size: 256-Bit Key