🔐 Key Management

What is envelope encryption?

Instead of encrypting your data directly with the master key, the platform generates a random data key (32 bytes) for each of your keys. Your data is encrypted with the data key (AES-256-GCM), and the data key itself is encrypted by the master key and stored wrapped. Result: the master key only ever wraps keys and never touches your data — the same principle used by major cloud encryption systems.

Your keys, under your control

Every key belongs to your account alone. You can create keys, rotate them (a new data key version, the old one kept so old data still decrypts), and disable them any time. A disabled key refuses new encryptions but can still decrypt — you always recover your data.

An audit trail for every operation

Every operation (create, encrypt, decrypt, rotate, disable) is logged with the time and IP address. The log carries metadata only — no keys, no ciphertexts, no decrypted data.

Endpoints

Code example

// Node.js — create a key, encrypt, decrypt (customer session cookie)
const base = 'https://securecelleouatine.com';
const k = await (await fetch(base + '/api/kms/keys', { method: 'POST' })).json();
const keyId = k.key_id; // ek_...

const enc = await (await fetch(base + '/api/kms/encrypt', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ key_id: keyId, plaintext_b64: Buffer.from('secret').toString('base64') })
})).json();
// enc.envelope = { v, iv, ct, tag } — store it, it only decrypts with this key

const dec = await (await fetch(base + '/api/kms/decrypt', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ key_id: keyId, envelope: enc.envelope })
})).json();
console.log(Buffer.from(dec.plaintext_b64, 'base64').toString()); // 'secret'

Security notes

1. The master key (32 random bytes) lives in a file on the server only, with restricted permissions; it never leaves the server and never appears in any interface.
2. If the master key is lost or the file deleted, all encryption stops immediately (503 error) — by design: no master key = no encryption, no degraded mode.
3. Random data keys are wiped from memory right after use and are never logged.
4. Every envelope is bound to its key and version (additional authenticated data) — it cannot be replayed against another key.
5. Single-master-key design: simple and transparent, but not an HSM — root access to the server could theoretically read the file. Back it up somewhere safe.