Bring your own encryption

{{Short description|Computer security practice}}

Bring your own encryption (BYOE), also known as bring your own key (BYOK), is a cloud computing security model that allows cloud service customers to use their own encryption software and manage their own encryption keys.{{cite web|last1=Rouse|first1=Margaret|title=BYOE(Bring Your Own Encryption)|url=http://whatis.techtarget.com/definition/BYOE-bring-your-own-encryption|website=What Is|accessdate=10 April 2015|date=22 February 2014}} BYOE enables cloud service customers to utilize a virtual instance of their encryption software alongside their cloud-hosted business applications to encrypt their data.{{Cite web |last= |first= |date=2021-09-21 |title=Control of Your Cloud Data Encryption with Bring Your Own Encryption (BYOE) |url=https://parachute.cloud/ |access-date=2023-12-25 |website=parachute.cloud |language=en-US}}

In this model, hosted business applications are configured to process all data through the encryption software. This software then writes the ciphertext version of the data to the cloud service provider's physical data store and decrypts ciphertext data upon retrieval requests.{{cite web|last1=Steve|first1=Wexier|title=Solving Cloud Security Will Open Adoption Floodgates|url=http://it-tna.com/2014/03/24/solving-cloud-security-will-open-adoption-floodgates/|website=IT Trends & Analysis|accessdate=10 April 2015|date=24 March 2014|archive-url=https://web.archive.org/web/20150420014723/http://it-tna.com/2014/03/24/solving-cloud-security-will-open-adoption-floodgates/|archive-date=20 April 2015|url-status=dead}} This approach provides enterprises with control over their keys and the ability to generate their own master key using internal hardware security modules (HSM), which are then transmitted to the cloud provider's HSM.{{cite web|last1=Zhang|first1=Hongwen|title=Bring your own encryption: New term in the cloud age|url=http://www.networksasia.net/article/bring-your-own-encryption-new-term-cloud-age.1428310233|website=Networks Asia|accessdate=10 April 2015|date=6 April 2015|url-status=dead|archive-url=https://web.archive.org/web/20170814222524/http://www.networksasia.net/article/bring-your-own-encryption-new-term-cloud-age.1428310233|archive-date=14 August 2017}}

When the data is no longer needed, such as when users discontinue the cloud service, the keys can be deleted, rendering the encrypted data permanently inaccessible. This practice is known as crypto-shredding.