Managing Master Encryption Key

AppViewX employs an envelope encryption technique to protect all sensitive information, using the AWS Key Management Service (KMS) keys. This process involves encrypting plaintext data using an encryption key, called the AppViewX Master Encryption Key (MEK). The AppViewX MEK is encrypted with a Master Encryption Key (KMS-MEK) maintained in the AWS KMS when storing it at rest or during transit. User's can choose to encrypt the AppViewX MEK with an encryption key stored in their HSM. This encryption key is the user’s Master Encryption Key. As a result, the AppViewX MEK used to encrypt secure materials is encrypted twice; first, using the Master Key stored in KMS, and then using the user’s Master Key stored in the HSM. If the user's Master Key is removed from the HSM, the AppViewX MEK cannot be used to access the data, making it inaccessible and irrecoverable.