Key management & secrets
Keys and secrets are where good security usually fails. Our team designs key hierarchies, sets up managed key services and secret stores, and replaces credentials scattered in files with controlled, audited access.
Our team has worked with key management services on Amazon Web Services (AWS), Google Cloud and Oracle Cloud Infrastructure (OCI), and with secret stores for applications and administrators. We design the key hierarchy, decide who can use a key without being able to read it, and move passwords and tokens out of code, chat and spreadsheets.
Delivery is practical and staged. We inventory where secrets live today, replace the riskiest first with managed stores and short-lived credentials, and write the rotation and recovery procedures. Recovery matters as much as protection: a key that cannot be restored is a data-loss event waiting to happen.
What we do
- Key hierarchy design with rotation schedules
- Managed key service setup on AWS, Google Cloud, Microsoft Azure and OCI
- Customer-managed keys for storage, databases and backups
- Secret store deployment and application integration
- Removing credentials from code and shared files
- Escrow and recovery procedures for irreplaceable keys
- HSM planning and integration
- Audit logging of key and secret access
Where a business needs it, we plan hardware security modules and escrow so a lost key does not mean lost data. We have worked with key management on Amazon Web Services (AWS) with AWS Key Management Service (AWS KMS), AWS CloudHSM and AWS Secrets Manager, on Google Cloud with Cloud KMS, Cloud HSM and Secret Manager, on Microsoft Azure with Azure Key Vault, and on Oracle Cloud Infrastructure (OCI) with Oracle Cloud Infrastructure Vault (OCI Vault).
Key management supports Cybersecurity, Cloud Management and Tailored Software. Encrypted backups, signing keys, database credentials and API tokens all depend on getting this layer right.
Leading platforms we work with
- OpenBao
- AWS Key Management Service (AWS KMS)
- AWS CloudHSM
- AWS Secrets Manager
- Google Cloud Key Management Service (Cloud KMS)
- Google Cloud HSM
- Google Cloud Secret Manager
- Azure Key Vault
- Azure Key Vault Managed HSM
- Oracle Cloud Infrastructure Vault (OCI Vault)
- HashiCorp Vault
- Thales
- Entrust
- Utimaco
Platforms and practices
- Hardware security modules (HSM)
- Google Cloud External Key Manager (Cloud EKM)
- Cloudflare Secrets Store
- SOPS
- age
- Key rotation & escrow design
References
- OpenBao project (OpenSSF / Linux Foundation, Vault fork)
- AWS: AWS Key Management Service (AWS KMS)
- AWS: AWS CloudHSM
- AWS: AWS Secrets Manager
- Google Cloud: Cloud KMS, Cloud HSM, Cloud EKM and Autokey
- Google Cloud: Secret Manager
- Microsoft Learn: Azure Key Vault Managed HSM
- Microsoft Azure: Azure Key Vault
- Oracle: OCI Vault (Key Management)
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageDo you design key rotation and recovery?
Yes. We plan rotation, escrow and recovery so that losing one key or one person does not lock you out.
Can you use hardware security modules?
Yes, where the risk justifies it. We will tell you if a managed cloud key service is enough.
Where should application secrets be stored?
In a secret store or managed service with access control and an audit log, such as a cloud secret manager, and injected into the application at run time. Not in source code, container images, chat or shared documents. For files in a repository, SOPS or age encrypt the values before they are committed.
How often should keys be rotated?
Rotate on a schedule driven by risk, the provider's guidance and any regulation, and immediately after suspected exposure or when a person with access leaves. Rotation only works if it is automated or documented and tested, since a rotation that breaks production tends to be postponed. Short-lived credentials reduce how much rotation you need.
What is key escrow and when do we need it?
Escrow is a protected copy of a key kept by a separate party or in a separate place, so that losing the original does not mean losing the data. It is needed for keys that cannot be reissued, such as encryption keys for primary data or signing keys. Escrow copies need stricter access than the working key, because they are an extra target.
What is envelope encryption?
A data key encrypts the data, and a master key in a key management service or HSM encrypts that data key. Only the small data key is ever sent to the master key, so large data stays local while the master key never leaves protected hardware. It also allows rotating the master key without re-encrypting all the data.