Who Holds the Keys? Exploring GYOK, BYOK, and HYOK for Cloud Sovereignty

The security of encrypted data is only as strong as the protection of its cryptographic keys. As organizations increasingly migrate sensitive workloads to the cloud, they face a critical challenge: how to leverage the flexibility and scalability of the cloud while maintaining a robust security posture for the keys that protect their most valuable information.

This whitepaper explores three key management strategies in the cloud: Get Your Own Key (GYOK), Bring Your Own Key (BYOK), and Hold Your Own Key (HYOK). It illustrates how these models offer varying degrees of control, responsibility, and security—and serves as a practical framework to help organizations find the right balance for their specific needs.

The three models in brief:

·       GYOK: Maximum integration and convenience—paired with a high level of dependence on the cloud provider.

·       BYOK: Shared control and improved compliance—at the cost of additional administrative effort.

·       HYOK: Full sovereignty over keys and data—but with greater operational complexity and potential limitations in cloud functionality.

Find out which key management model best fits your security strategy—and how Confidential Computing helps you maintain control of your data in the cloud.

‍