Skip to main content
Every Corsa workspace is encrypted at rest (AES-256) and in transit (TLS 1.2+). With Corsa-managed keys, you can also encrypt individual sensitive client fields, such as names, contact details and government ID numbers, with a dedicated key that Corsa operates in AWS KMS. You don’t run anything in your own cloud. Every product feature keeps working on the protected fields, including rules, fuzzy sanctions and PEP screening, search, KYC integrations, AI features and exports.
Corsa-managed keys protect sensitive fields from anyone who can read Corsa’s storage, backups or logs. They don’t hide plaintext from Corsa: Corsa operates the key and decrypts on its servers. If you need to own the key and revoke Corsa’s access, see BYOK. If stored sensitive fields must stay unreadable to Corsa, see HYOK.

​
How it works

  1. When a protected field is written through any path (API, SDK, KYC integration or the app), Corsa’s isolated encryption service asks the Corsa-managed KMS key for a data key. It encrypts the field with AES-256-GCM.
  2. Every KMS call carries the encryption context platformId = <your workspace ID>, so a data key created for your workspace can’t be used for another workspace.
  3. Each encrypted value is bound to its workspace, entity type and field. Corsa rejects a value that was copied to a different field or workspace.
  4. Corsa stores the encrypted value and a keyed search index, computed with a secret that’s unique to your workspace. It never stores the plaintext of protected fields.
  5. When a signed-in user or an API caller with access reads the field, the encryption service decrypts it and returns the plaintext.
Corsa caches decrypted data keys in memory for a few minutes and reuses one data key for a short window of new writes. This keeps encryption fast on high-volume ingestion.

​
Corsa-managed keys compared with BYOK and HYOK

See encryption tiers for the full comparison.

​
Turn on Corsa-managed keys

1

Open the encryption settings

A workspace Owner opens Settings → Developers → Encryption.
2

Choose the tier

Under Encryption tier, select Corsa-managed key. No key, stack or verification step is needed.
3

Choose the fields to protect

Select the sensitive fields to encrypt, such as names, government ID numbers and contact details, and save. See fields you can encrypt.
From then on, Corsa encrypts the selected fields on every write. You don’t need to change your API calls, SDK code or KYC integrations: send plaintext as before, and Corsa encrypts it on the server.
You choose one tier per workspace. Once Corsa-managed keys are active, you can’t switch to BYOK or HYOK, or remove encrypted fields, yourself. Contact your Corsa representative to plan a change. If you don’t see the Encryption page, ask your Corsa representative to enable it for your workspace.
Only workspace Owners can change the encryption configuration. Members with the Support role can view it.

​
Search and screening on protected fields

  • Search. Exact-match search, such as finding a client by email address or ID number, uses the keyed search index. It works without decrypting stored values.
  • Screening and rules. Sanctions and PEP screening, rules and workflows read the decrypted values on Corsa’s servers. Fuzzy name matching keeps working.
  • AI features and exports. These read decrypted values, like any other Corsa feature.

​
Check your configuration

Use GET /v1/platforms/encryption-config to read your workspace’s encryption configuration. With Corsa-managed keys, deploymentModel is saas and encryptionFieldsList lists the protected fields. A 204 No Content response means you haven’t set up field-level encryption. Your data is still encrypted at rest and in transit.

​
If decryption is unavailable

If the encryption service can’t decrypt a value, for example during a KMS outage, Corsa fails closed. It never returns ciphertext as if it were plaintext:
  • Reads return the field as [encrypted:DECRYPT_UNAVAILABLE] instead of the value. Other fields in the response are unaffected.
  • Writes of protected fields fail with a retryable error, so no plaintext is stored by mistake. Retry the request.
Contact Corsa support if masked values persist.
Learn more about Corsa’s security approach, or schedule a demo to discuss your encryption requirements.